Veryfing tempered data

[Akeru <ik...@gmx.net>]

Hello dear readers,
I would like to get an enlightment on a problem I have here, I am rather new 
to the xml-security so I might have missed a simple point.

Here is the problem : I have a envelopped signature with an XML message, when 
I temper with the content of the message, and verify it again, I don't get 
any errors, which should not be the case. The modification are done this 
way : output to a File stream the signed document mody it then pqrsing it 
back and try to verify the signature. The certificate is correcly validated 
but I don't get any errors telling me the hashs are different.

I tried to put in the Reference uri the message id (<ds:Reference URI="#id">) 
but without any succes either.

Thank you very much for your time.

Akeru.

PS : Here is the message :

<message Id="id">
	message content here
	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="IB">
	<ds:SignedInfo>
		<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001 
REC-xml-c14n-20010315">
		</ds:CanonicalizationMethod>
		<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1">
		</ds:SignatureMethod>
		<ds:Reference URI="">
		<ds:Transforms>
			<ds:Transform Algorithm="http://www.w3.org/2000/09/	
xmldsig#enveloped-signature">
		</ds:Transform>
		</ds:Transforms>
			<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1">
			</ds:DigestMethod>
			<ds:DigestValue>D1Dxy1CGON5SCt2rzm2NFvHfpu0=</ds:DigestValue>
			</ds:Reference>
	</ds:SignedInfo>
	<ds:SignatureValue> Encrypted digest value </ds:SignatureValue>
	<ds:KeyInfo>
		<ds:X509Data>
			<ds:X509Certificate>
				Certificate here
			</ds:X509Certificate>
		</ds:X509Data>
	</ds:KeyInfo>
	</ds:Signature>
</message>

Re: [SOLVED]Veryfing tempered data

[Akeru <ik...@gmx.net>]

I solved my issue in such a simple way I am a bit ashamed : 

I thought signature.checkSignatureValue() would throw me an exception if the 
checking failed, but it is not the case since a boolean is returned, so a 
simple if() did the job

I hope I did not waste too much of your time,
thank you for the help,

Best regards,
Akeru.

Re: Veryfing tempered data

[Akeru <ik...@gmx.net>]

Milan Tomic wrote :
> You haven't told us which libraries (and version) are you using:
> C++ or Java? Also, some code samples would help.

Oops, sorry, I'm using Java libraries version 1.0.4, here is how the 
verfication is done :

public void verifySignature(String message) throws Exception  {

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();	
dbf.setNamespaceAware(true);
DocumentBuilder db = dbf.newDocumentBuilder();
m_document = db.newDocument();
// we got a string we want a stream			
m_document = db.parse(new ByteArrayInputStream(message.getBytes()));
m_root = m_document.getDocumentElement();

Element nscontext = XMLUtils.createDSctx(m_document, "ds", 
Constants.SignatureSpecNS);

Element sigElement = (Element) XPathAPI.selectSingleNode(m_document, "//
ds:Signature", nscontext);

XMLSignature signature = new XMLSignature(sigElement, "");
KeyInfo ki = signature.getKeyInfo();

X509Certificate cert = signature.getKeyInfo().getX509Certificate();				
cert.checkValidity();				
signature.checkSignatureValue(cert);
}

There are of course verfication if the message actually contains the signature 
and the certificate but this would be too long to paste it here.

Regards, Akeru.

RE: Veryfing tempered data

[Milan Tomic <mi...@setcce.org>]

	You haven't told us which libraries (and version) are you using:
C++ or Java? Also, some code samples would help. If you are using C++
library: there was a bug which limited node's value size to 16K. If you
are using 1.00 version of libraries you can download those files from
cvs to fix a problem:

XSECCannon.cpp
XSECC14n20010315.hpp
XSECC14n20010315.cpp

Best regards,
Milan