SHA-1 digest differences

Thread view:

Roedy Green - 06 Oct 2005 05:25 GMT

The SHA-1 digest for each member of a signed jar appears in two
places:

MANIFEST.MF
and *.SF

The digests for each member differ. Why is that?

Are the digests in *.SF individually encrypted with the private key? I
would have thought just the list of digests' digest would need
encryption.

Signature

Canadian Mind Products, Roedy Green.
http://mindprod.com Again taking new Java programming contracts.

Reply to this Message

Roedy Green - 06 Oct 2005 05:54 GMT

>Are the digests in *.SF individually encrypted with the private key? I
>would have thought just the list of digests' digest would need
>encryption.

I did an experiment, signing the same jar with a DSA cert then an RSA
cert. The digests all remain the same.

So there seem to be two flavours of SHA-1 digests or perhaps two
flavours of armouring them.

Signature

Canadian Mind Products, Roedy Green.
http://mindprod.com Again taking new Java programming contracts.

Reply to this Message

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...