RSA Digital Signature Tool (java, written by Claude Code)

Claude Code wrote this java project from the task below. It installed and ran on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: RSA Digital Signature Tool

Write a program that generates RSA key pairs and uses them to create and verify digital signatures on files, ensuring document authenticity and integrity.

FUNCTIONAL REQUIREMENTS:
- Support three subcommands: keygen, sign, and verify
- keygen: Generate an RSA key pair (2048 or 4096 bit, selectable via --bits flag, default 2048) and save the private key and public key as separate PEM files
- sign: Accept a file path and private key path, compute a SHA-256 hash of the file, sign it with RSA-PSS padding, and save the signature as a separate .sig file
- verify: Accept a file path, signature file path, and public key path, then verify the signature and print whether it is valid or invalid with details
- Support signing multiple files at once by accepting a directory path via --batch flag
- Support a --output flag to specify where to save generated keys or signatures
- Display key information: key size, fingerprint (SHA-256 hash of public key), and creation timestamp
- Support exporting the public key in both PEM and DER formats via --format flag
- Print detailed results to console: for signing show the file hash and signature size, for verification show match/mismatch status and key details
- If no arguments are given, generate a sample key pair, create a sample text file, sign it, verify the signature, then tamper with the file and show that verification fails
- Handle errors gracefully: invalid key format, mismatched key/signature, corrupted files, unsupported key sizes

Create a complete Java project for a clean Ubuntu 22.04 machine with only JDK 17+ installed. Include:
- Source code
- pom.xml with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>rsa-signer</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

    <name>RSA Digital Signature Tool</name>
    <description>Sign and verify files using RSA with SHA-256 (JCA built-in)</description>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.3.0</version>
                <configuration>
                    <archive>
                        <manifest>
                            <mainClass>signer.RsaSigner</mainClass>
                        </manifest>
                    </archive>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.12.1</version>
                <configuration>
                    <source>11</source>
                    <target>11</target>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

# RSA Digital Signature Tool (Java - JCA Built-in)

Sign and verify files using RSA-2048/4096 with SHA-256 using Java's built-in JCA.

## Build

```bash
mvn clean package
```

## Usage

```bash
# Generate key pair
java -jar target/rsa-signer-1.0.0.jar keygen --bits 2048

# Sign a file
java -jar target/rsa-signer-1.0.0.jar sign myfile.txt --key private.pem

# Verify a signature
java -jar target/rsa-signer-1.0.0.jar verify myfile.txt --key public.pem

# Run demo (no arguments)
java -jar target/rsa-signer-1.0.0.jar
```

## Dependencies

- Java 11+ (no external dependencies, uses built-in JCA)

package signer;

import java.io.*;
import java.nio.file.*;
import java.security.*;
import java.security.spec.*;
import java.util.Base64;

/**
 * RSA Digital Signature Tool using built-in Java Cryptography Architecture (JCA).
 * Signs and verifies files using RSA-2048/4096 with SHA-256.
 */
public class RsaSigner {

    private static final String ALGORITHM = "RSA";
    private static final String SIGNATURE_ALGORITHM = "SHA256withRSA";

    public static void generateKeys(String privateKeyPath, String publicKeyPath, int keySize) throws Exception {
        KeyPairGenerator generator = KeyPairGenerator.getInstance(ALGORITHM);
        generator.initialize(keySize, new SecureRandom());
        KeyPair keyPair = generator.generateKeyPair();

        // Save private key in PEM format
        writePemFile(privateKeyPath, "RSA PRIVATE KEY", keyPair.getPrivate().getEncoded());

        // Save public key in PEM format
        writePemFile(publicKeyPath, "PUBLIC KEY", keyPair.getPublic().getEncoded());

        System.out.println("Keys generated: " + privateKeyPath + ", " + publicKeyPath);
    }

    public static void signFile(String filePath, String privateKeyPath, String signaturePath) throws Exception {
        byte[] keyBytes = readPemFile(privateKeyPath);
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
        PrivateKey privateKey = keyFactory.generatePrivate(keySpec);

        Signature signature = Signature.getInstance(SIGNATURE_ALGORITHM);
        signature.initSign(privateKey);

        byte[] fileData = Files.readAllBytes(Paths.get(filePath));
        signature.update(fileData);
        byte[] sig = signature.sign();

        Files.write(Paths.get(signaturePath), sig);
        System.out.println("Signature written to " + signaturePath);
    }

    public static boolean verifyFile(String filePath, String publicKeyPath, String signaturePath) throws Exception {
        byte[] keyBytes = readPemFile(publicKeyPath);
        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
        KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);
        PublicKey publicKey = keyFactory.generatePublic(keySpec);

        Signature signature = Signature.getInstance(SIGNATURE_ALGORITHM);
        signature.initVerify(publicKey);

        byte[] fileData = Files.readAllBytes(Paths.get(filePath));
        signature.update(fileData);

        byte[] sigBytes = Files.readAllBytes(Paths.get(signaturePath));
        boolean valid = signature.verify(sigBytes);

        System.out.println("Signature is " + (valid ? "VALID" : "INVALID") + ".");
        return valid;
    }

    private static void writePemFile(String path, String type, byte[] encoded) throws IOException {
        String base64 = Base64.getMimeEncoder(64, "\n".getBytes()).encodeToString(encoded);
        String pem = "-----BEGIN " + type + "-----\n" + base64 + "\n-----END " + type + "-----\n";
        Files.write(Paths.get(path), pem.getBytes());
    }

    private static byte[] readPemFile(String path) throws IOException {
        String pem = new String(Files.readAllBytes(Paths.get(path)));
        pem = pem.replaceAll("-----BEGIN .*-----", "")
                  .replaceAll("-----END .*-----", "")
                  .replaceAll("\\s", "");
        return Base64.getDecoder().decode(pem);
    }

    private static void demo() throws Exception {
        System.out.println("=== RSA Digital Signature Tool Demo ===\n");

        String privPath = "demo_private.pem";
        String pubPath = "demo_public.pem";
        String demoFile = "demo_message.txt";
        String sigPath = "demo_message.txt.sig";

        System.out.println("1. Generating RSA-2048 key pair...");
        generateKeys(privPath, pubPath, 2048);

        Files.write(Paths.get(demoFile), "This is a demo message for RSA signature verification.\n".getBytes());
        System.out.println("\n2. Created demo file: " + demoFile);

        System.out.println("\n3. Signing file...");
        signFile(demoFile, privPath, sigPath);

        System.out.println("\n4. Verifying signature...");
        verifyFile(demoFile, pubPath, sigPath);

        System.out.println("\n5. Tampering with file and verifying again...");
        Files.write(Paths.get(demoFile), "This message has been tampered with!\n".getBytes());
        verifyFile(demoFile, pubPath, sigPath);

        // Cleanup
        for (String p : new String[]{privPath, pubPath, demoFile, sigPath}) {
            Files.deleteIfExists(Paths.get(p));
        }
        System.out.println("\n6. Cleaned up demo files.");
    }

    public static void main(String[] args) throws Exception {
        if (args.length == 0) {
            demo();
            return;
        }

        String command = args[0];

        switch (command) {
            case "keygen": {
                String privKey = "private.pem";
                String pubKey = "public.pem";
                int bits = 2048;
                for (int i = 1; i < args.length; i++) {
                    switch (args[i]) {
                        case "--private": privKey = args[++i]; break;
                        case "--public": pubKey = args[++i]; break;
                        case "--bits": bits = Integer.parseInt(args[++i]); break;
                    }
                }
                generateKeys(privKey, pubKey, bits);
                break;
            }
            case "sign": {
                String file = args[1];
                String key = "private.pem";
                String output = file + ".sig";
                for (int i = 2; i < args.length; i++) {
                    switch (args[i]) {
                        case "--key": key = args[++i]; break;
                        case "--output": output = args[++i]; break;
                    }
                }
                signFile(file, key, output);
                break;
            }
            case "verify": {
                String file = args[1];
                String key = "public.pem";
                String sig = file + ".sig";
                for (int i = 2; i < args.length; i++) {
                    switch (args[i]) {
                        case "--key": key = args[++i]; break;
                        case "--signature": sig = args[++i]; break;
                    }
                }
                boolean valid = verifyFile(file, key, sig);
                System.exit(valid ? 0 : 1);
                break;
            }
            default:
                System.err.println("Unknown command: " + command);
                System.err.println("Usage: java RsaSigner [keygen|sign|verify]");
                System.exit(1);
        }
    }
}