You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by Matej Kafadar <ma...@setcce.org> on 2004/06/30 09:41:26 UTC

Is XML signature valid?

Hi,

Milan posted two signed (enveloped) XML files signed in java (see
attachment). One is with stylesheet and other without it. Both signatures
are valid verified by java libraries. File "test_with_stylesheet_java.xml"
is not valid verified by C++ libraries.

Is  XML signature "test_with_stylesheet_java.xml" valid or not (java says
YES, C++ says no).

Best regards

    Matej


----- Original Message ----- 
From: "Milan Tomic" <mi...@setcce.org>
To: <se...@xml.apache.org>
Sent: Monday, June 28, 2004 1:16 PM
Subject: RE: With comments


> Berin,
>
> > Hmm, don't like that!  Can you send me the full document as an
> > attachment?  The library definitely supports WithComments, so it
> > shouldn't be an issue there.
> I belive I've found what the problem is. Interoperability between Java &
> C++ libraries fails when there is XML pre processing instruction for
> stylesheet in XMl file. I'm attaching both XML files, with and without
> stylesheet instruction. XML file with stylesheet instruction have
> invalid signature in C++ and valid in Java XSEC library.
>
> Best regards,
> Milan
>

Re: Is XML signature valid?

Posted by Matej Kafadar <ma...@setcce.org>.
String toSign is a absolute path to XML file to sign. File is attached.

regards

    Matej


> > Part of code:
> >
> >       Document doc = db.parse(toSign);
> >       Element root = doc.getDocumentElement();
> >       XMLSignature sig = new XMLSignature(doc,
> > null,XMLSignature.ALGO_ID_SIGNATURE_RSA);
> >       root.appendChild(sig.getElement());
> >       Transforms transforms = new Transforms(doc);
> >       transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE);
> >
transforms.addTransform(Transforms.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
> >       sig.addDocument("", transforms, Constants.ALGO_ID_DIGEST_SHA1);
> >       X509Certificate cert = (X509Certificate) ks.getCertificate(
> >           certificateAlias);
> >       sig.addKeyInfo(cert);
> >       sig.sign(pk);
> >
> > For signing is used Java xmlsec 1.1.
> >
> > Thank you,
>
> Can you send also the toSign String,
>
> Thanks,
>
> Raul
>

Re: Is XML signature valid?

Posted by ra...@r-bg.com.
> Part of code:
>
>       Document doc = db.parse(toSign);
>       Element root = doc.getDocumentElement();
>       XMLSignature sig = new XMLSignature(doc,
> null,XMLSignature.ALGO_ID_SIGNATURE_RSA);
>       root.appendChild(sig.getElement());
>       Transforms transforms = new Transforms(doc);
>       transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE);
>       transforms.addTransform(Transforms.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
>       sig.addDocument("", transforms, Constants.ALGO_ID_DIGEST_SHA1);
>       X509Certificate cert = (X509Certificate) ks.getCertificate(
>           certificateAlias);
>       sig.addKeyInfo(cert);
>       sig.sign(pk);
>
> For signing is used Java xmlsec 1.1.
>
> Thank you,

Can you send also the toSign String,

Thanks,

Raul

Re: Is XML signature valid?

Posted by Matej Kafadar <ma...@setcce.org>.
Part of code:

      Document doc = db.parse(toSign);
      Element root = doc.getDocumentElement();
      XMLSignature sig = new XMLSignature(doc,
null,XMLSignature.ALGO_ID_SIGNATURE_RSA);
      root.appendChild(sig.getElement());
      Transforms transforms = new Transforms(doc);
      transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE);
      transforms.addTransform(Transforms.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
      sig.addDocument("", transforms, Constants.ALGO_ID_DIGEST_SHA1);
      X509Certificate cert = (X509Certificate) ks.getCertificate(
          certificateAlias);
      sig.addKeyInfo(cert);
      sig.sign(pk);

For signing is used Java xmlsec 1.1.

Thank you,

    Matej


----- Original Message ----- 
From: <ra...@r-bg.com>
To: <se...@xml.apache.org>
Sent: Wednesday, June 30, 2004 11:14 AM
Subject: Re: Is XML signature valid?


> > Hi,
> >
> > Milan posted two signed (enveloped) XML files signed in java (see
> > attachment). One is with stylesheet and other without it. Both
signatures
> > are valid verified by java libraries. File
"test_with_stylesheet_java.xml"
> > is not valid verified by C++ libraries.
> >
> > Is  XML signature "test_with_stylesheet_java.xml" valid or not (java
says
> > YES, C++ says no).
> >
> > Best regards
> >
> >     Matej
> >
> I think that that the test_with_stylesheet_java.xml is invalid, regarding
> the C14N method. It needs a \r in the first line. But for better
> diagnostic I need to know how the xml file was created and wich version of
> java was used.
> So I can look at the code and correct the generation and verification of
> this kind of signature.
>
> Regards.
>
>
> Raul

Re: Is XML signature valid?

Posted by ra...@r-bg.com.
> Hi,
>
> Milan posted two signed (enveloped) XML files signed in java (see
> attachment). One is with stylesheet and other without it. Both signatures
> are valid verified by java libraries. File "test_with_stylesheet_java.xml"
> is not valid verified by C++ libraries.
>
> Is  XML signature "test_with_stylesheet_java.xml" valid or not (java says
> YES, C++ says no).
>
> Best regards
>
>     Matej
>
I think that that the test_with_stylesheet_java.xml is invalid, regarding
the C14N method. It needs a \r in the first line. But for better
diagnostic I need to know how the xml file was created and wich version of
java was used.
So I can look at the code and correct the generation and verification of
this kind of signature.

Regards.


Raul