Skip to content

Fix/java8 signature format#2

Open
oleksandrlazarenko-pi wants to merge 3 commits into
SWAN-community:mainfrom
51Degrees:fix/java8-signature-format
Open

Fix/java8 signature format#2
oleksandrlazarenko-pi wants to merge 3 commits into
SWAN-community:mainfrom
51Degrees:fix/java8-signature-format

Conversation

@oleksandrlazarenko-pi

@oleksandrlazarenko-pi oleksandrlazarenko-pi commented Jul 7, 2026

Copy link
Copy Markdown

Summary

Replaces the SHA256withECDSAinP1363Format signature algorithm with the
standard SHA256withECDSA, converting between ASN.1 DER and the raw 64-byte
(IEEE P1363) form in code. The wire format is unchanged; the library now signs
and verifies on Java 8 instead of requiring Java 15+.

Motivation

SHA256withECDSAinP1363Format was only added to the JDK in Java 15. Since
this library targets Java 8 (maven.compiler.release=8), any consumer on Java
8-14 hit NoSuchAlgorithmException: SHA256withECDSAinP1363Format Signature not available the moment they signed or verified — which surfaced as CI failures in
a downstream Java 8 project:

com.swancommunity.owid.OwidException: key operation failed because
  SHA256withECDSAinP1363Format Signature not available
Caused by: java.security.NoSuchAlgorithmException

So the Java-8 compile target was misleading: the crypto still needed Java 15+.
The PHP implementation already avoids this (it uses SHA256withECDSA +
derToRaw/rawToDer); this change brings owid-java in line.

Changes (Crypto.java)

  • SIGNATURE_ALGORITHMSHA256withECDSA (DER; available since Java 7).
  • signByteArray converts the DER signature to the raw 64-byte form via a new
    derToRaw; verifyByteArray converts the raw 64 bytes back to DER via
    rawToDer before verifying.
  • Added minimal, dependency-free ASN.1 helpers (derToRaw, rawToDer,
    readDerLength, readDerInteger, padCoordinate, encodeDerInteger,
    encodeDerLength, trimLeadingZeros) — all pure byte manipulation, Java 8 safe.

Compatibility

  • Wire format unchanged — the emitted signature is still the raw 32-byte r
    followed by the 32-byte s. The existing WireVectorsTest and FixturesTest
    (cross-language vectors) pass unchanged, confirming byte-for-byte interop with
    owid-js / owid-php / owid-python / owid-dotnet.
  • API unchanged — no public method signatures change.

Testing

  • owid-java: mvn clean test35/35 pass (incl. CryptoTest sign/verify
    round-trips and the wire-format fixtures).
  • Downstream Java 8 reader: 32/32 pass, with an animal-sniffer java18 API
    check confirming only Java 8 APIs are used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant