You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@santuario.apache.org by "john james mustard (Jira)" <ji...@apache.org> on 2021/07/26 12:40:00 UTC
[jira] [Updated] (SANTUARIO-571) A signature generated by JAVA
8.0_231 (and above) doesn't match that generated by 8.0_121
[ https://issues.apache.org/jira/browse/SANTUARIO-571?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
john james mustard updated SANTUARIO-571:
-----------------------------------------
Summary: A signature generated by JAVA 8.0_231 (and above) doesn't match that generated by 8.0_121 (was: A signature generated by JAVA 8.0_131 doesn't match that generated by 8.0_121)
> A signature generated by JAVA 8.0_231 (and above) doesn't match that generated by 8.0_121
> -----------------------------------------------------------------------------------------
>
> Key: SANTUARIO-571
> URL: https://issues.apache.org/jira/browse/SANTUARIO-571
> Project: Santuario
> Issue Type: Bug
> Components: Java
> Affects Versions: Java 2.1.3
> Environment: Windows 10, Java
> Reporter: john james mustard
> Assignee: Colm O hEigeartaigh
> Priority: Minor
> Labels: encryption
> Attachments: V221 LookupRPN message 2021_07_21 17_21_47.xml, v301 LookupRPN message 2021_07_21 17_00_15.xml
>
>
> As I understand it from JAVA 8.0_231 upgraded the Apache Santuario libraries to v2.1.3. From that point a signature using <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/> generates an invalid signature.
> I have attached signed files generated using JAVA 8.0_221 and one using JAVA 8.0_301 - all versions from 231 upwards generate invalid signature.
> The signature is a requirement of the ROI Revenue services. We have a JAR file set up to generate the signature.
> Hopefully this may be fixed by adding additional instructions to the JAR file. I can supply the JAR file and the unsigned XML if required used to generate the signed XML.
>
> I don't know if this is considered a JAVA issue or an Apache issue
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)