private void check_sig(WebauthResponse response) throws WebauthException {

		try {
			Certificate cert = keyStore.getCertificate(keyPrefix
					+ response.get("kid"));
			if (cert == null) {
				throw new WebauthException("Failed to retrieve a key with "
						+ "alias " + keyPrefix + response.get("kid")
						+ " from the key store");
			}

			WebauthDecoder decoder = new WebauthDecoder();
			byte[] sigBytes = decoder.decodeBuffer(response.get("sig"));

			Signature signature = Signature.getInstance(SIGNATURE_SCHEME);
			signature.initVerify(cert);
			signature.update(response.getRawData().getBytes());

			if (!signature.verify(sigBytes)) {
				throw new WebauthException(
						"Unable to verify response signature");
			}
		} catch (KeyStoreException e) {
			throw new WebauthException("Validator keyStore object "
					+ "not correctly initialized");
		} catch (IOException e) {
			throw new WebauthException("Failed to decode signature string");
		} catch (NoSuchAlgorithmException e) {
			throw new WebauthException("No security provider implementing "
					+ "signature scheme " + SIGNATURE_SCHEME
					+ " available in this VM");
		} catch (InvalidKeyException e) {
			throw new WebauthException("Key with alias " + keyPrefix
					+ response.get("kid") + " in the key store is invalid");
		} catch (SignatureException e) {
			throw new WebauthException("Failed to verify signature - "
					+ "signature object is not initialized");
		}

	}