吞异常，太恶心了。org.bouncycastle.crypto.signers.SM2Signer#verifySignature(byte[])

[wangzongying]

这个sm2验签方法吞异常，当传入的签名值不太符合规范时，或者BigInteger是无符号数，导致解析为负数时，异常被吞。直接返回false。害人不浅。

[wangzongying]

public boolean verifySignature(byte[] signature)
{
try
{
BigInteger[] rs = encoding.decode(ecParams.getN(), signature);

        return verifySignature(rs[0], rs[1]);
    }
    catch (Exception e)
    {
    }

    return false;
}

[peterdettman]

(translated) This SM2 signature verification method swallows exceptions when the input signature value doesn't conform to the specifications, or when the BigInteger is an unsigned number that is parsed as a negative number. It simply returns false. This is quite harmful.

It's unclear to me what you think the problem is here. Do you have a signature that you think is valid that is failing to verify? Are you using the default implementation of DSAEncoding (e.g. by calling new SM2Signer()) or have you written your own?

[ligefeiBouncycastle]

@wangzongying 感谢您提出的宝贵反馈。我们理解您在调试SM2签名验证时遇到的不便。

当前BC-Java库的设计选择是：验证方法只返回布尔值（true/false），不暴露内部异常细节。这是出于以下考虑：

• API简洁性：保持验证接口简单统一

• 安全原则：避免通过错误信息泄露系统内部状态

对于调试困难的问题，我们建议：

• 在调用verifySignature前，先对输入数据进行基本验证

• 确保签名生成符合SM2规范

为了更准确地分析您遇到的问题，请提供您正在使用的SM2签名示例（有效或验证失败的案例）。 这将帮助我们更好地理解具体是哪种格式问题导致了验证失败。

我们将此反馈纳入讨论，将在后续版本中评估是否需要增加调试支持（如可选日志记录或详细错误码），同时保持现有API的稳定性。

[ligefeiBouncycastle]

@peterdettman

The user is raising a concern about the SM2 signature verification API. Their issue isn't about a specific valid signature failing verification, but rather about the debugging experience when verification fails.

Should we consider adding optional diagnostic capabilities? For example:
Add a debug mode via system property
-- Would log specific failure reasons to a configurable logger
-- Can be disabled by default for production