title: SHA256 with RSA signature returns different outputs on various Android devices
body: <p>I am developping an Android app, and I need to use <a href="http://developer.android.com/reference/java/security/Signature.html">java <code>Signature</code> class</a> for data authentication.</p>
  
  <p>On each Android device, I can sign data and verify its signature. However, given a definite chunk of data to sign, a definite modulus, a definite private exponent and a definite public exponent, the outputs of my signatures are different, depending on devices. I did try with bunch of devices, and I obtain the same signatures for Android 3.2 and 3.2.1, but a differents for an Android 2.2.x device.</p>
  
  <p>I compute these signature from constant fields that I generated previously using a <code>KeyFactory</code> with RSA in a java project. The keysize is 2048bit.</p>
  
  <p>Here is a quote of the code that I use to invoque Signature and Verification.</p>
  
  <pre class="lang-java prettyprint-override"><code>public byte[] signData(byte[] data, PrivateKey privateKey) throws ... {
          Signature signature = Signature.getInstance("SHA256withRSA");
          signature.initSign(privateKey);
          signature.update(data);
          return signature.sign();
  }
  
  public boolean verifyData(byte[] data, byte[] sigBytes, PublicKey publicKey) throws ... {
          Signature signature = Signature.getInstance("SHA256withRSA");
          signature.initVerify(publicKey);
          signature.update(data);
          return signature.verify(sigBytes);
  }
  </code></pre>
  
  <p>If I am not mistaking, the signature using SHA256 with RSA is deterministic. Then how can I explain such a behaviour? Another interesting question, how could I make that work cross-devices, i.e. the signatures would be same, no mather which device I use?</p>
  
  <p>Thank you in advance, Franck!</p>