10

The apex crypto class is great but it appears to only be able to sign content. Is there any way to verify a signature in apex? I would expect a Crypto.verify() method but it doesn't appear to exist. I have some device which will be shipping me back a configuration file containing a signature and public key and I'm at a loss on how to successfully verify this. Was planning on using the SHA1 algorithm.

Has anyone dealt with this before?

Improve this question
9
  • Which Algorithm you want to use for Varify the Signature? It may be more helpful to provide you the Solution..
    – Tepsi
    Commented Nov 20, 2013 at 7:55
  • @Aisha Was planning on using SHA1
    – Jason Sims
    Commented Nov 20, 2013 at 16:34
  • I added some code in my answer may be it help you or ask me if you still have problem with more information of your problem
    – Tepsi
    Commented Nov 21, 2013 at 5:24
  • Are you able to varify now?
    – Tepsi
    Commented Nov 22, 2013 at 10:16
  • 1
    I'm facing the same problem - did you ever find a solution?
    – Keith C
    Commented Oct 1, 2014 at 18:08

2 Answers 2

Reset to default
5

You must follow the Following link it will be helpful for you to understand the Signature varification in Salesforce Apex. For SHA1 you can use the below code snippet:

private String getMac(String RequestString, String secretkey) {
String algorithmName = ‘hmacSHA1′; // the other options are: hmacMD5, hmacSHA256, and hmacSHA512
Blob input = Blob.valueOf(RequestString);
Blob signing =Crypto.generateMac(algorithmName, input, secretkey);
String str=EncodingUtil.urlEncode(EncodingUtil.base64Encode(signing), ‘UTF-8′);

use this str if you want signature in url encode if you want it in base64encode form only, then use the below code in place of str:

String str=EncodingUtil.base64Encode(signing);

For HMACSHA256 you can use the below code snippet:

string timestamp1 = datetime.now().formatGmt('EEE, d MMM yyyy HH:mm:ss Z');
String action = 'Action';
String algorithmName = 'HMACSHA256';
Blob mac = Crypto.generateMac(algorithmName, Blob.valueOf(timestamp1),
Blob.valueOf(Secretkey));
String macUrl =EncodingUtil.base64Encode(mac);

Use the str/macUrl where you want to use Signature may be it in the header if you use the POST method. For Sha-1 signature in APEX You can follow the below three links: http://www.tgerm.com/2012/07/sha-1-apex-rackspace-salesforce.html AND http://blog.jeffdouglas.com/2010/07/06/using-rsa-sha1-with-salesforce-crypto-class/ and http://wiki.developerforce.com/page/Apex_Crypto_Class

Improve this answer
3
  • Provide context for links Links to external resources are encouraged, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline.
    – sfdcfox ♦
    Commented Nov 20, 2013 at 13:18
  • The context is how to verify when you only have access to the "signature and public key" i.e. not the private key. I don't see that covered in your answer or am I missing something?
    – Keith C
    Commented Oct 1, 2014 at 18:13
  • 1
    Is there news about the solution ? I also need to check a signature using the signature and the public key
    – Raphym
    Commented Apr 19, 2017 at 12:50
1

I got this response on the subject from Salesforce support that confirms there is presently no direct solution in Apex:

crypto.verify method is not available is salesforce / apex

and that it is necessary to use:

third party app / external code

So it is necessary to create, deploy and call e.g. a Java Heroku app to get this done. A lot more work than calling an Apex API.

PS

Looks like methods have been added - see comment below.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .