'nother n00bie Q: Verifying the DSA signature?

[Nathan D. Bowen]

Dan Lyke wrote:

>-----BEGIN PmungedtonotscrewupemailersGP SIGNED MESSAGE-----
>Hash: DSA
>
>2005-05-20T18:30:09Z::assert_identity::http://www.livejournal.com/users/danlyke/::http://danlyke.gamahuche.com/openid.cgi
>-----BEGIN PmungedtonotscrewupemailersGP SIGNATURE-----
>Version: GnuPG v1.4.1 (GNU/Linux)
>
>MCwCabcVttGPXYZuML6vsHIYmKZZZZSUeAhR4JZEY9lLAYVxmbkrRNWWlt8ZPDw==
>
>-----END PmungedtonotscrewupemailersGP SIGNATURE-----
>  
>
Actually, you're really close. I spent a couple of hours last night 
before I finally got this working. In my case, I wasn't completely clear 
on the format of the string in the "body", but it looks like you read 
the spec just fine -- your input string looks perfect to me. I believe 
you're running into a problem because PGP doesn't actually sign the 
*body* of the message iteslf; PGP provides a signature of a hash of the 
body of the message.

In other words, you're not going to be able to test this with PGP because:

PGP is expecting to verify something like:
    BASE64(DSA(MD5("2005-05-20T18:30:09Z::assert_identity::blahblah")))
But OpenID creates its signatures with:
    BASE64(DSA("2005-05-20T18:30:09Z::assert_identity::blahblah"))

I tried to "test it by hand", but not with gpg. I was using openssl 
command lines, but with no more luck than you're having with gpg. 
Eventually I gave up on "testing it by hand", and it turned out to work 
just fine from my own code using the algorithms directly. I hope all of 
the above makes enough sense to get you going, but this stuff can be a 
lot easier to show than to tell -- so just let me know if you'd like to 
just see the java code I'm using.