You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by Maximilian Hütter <mh...@blue-elephant-systems.com> on 2007/07/17 10:28:16 UTC
Problem with verfiying Signature
Hi all,
I hope somebody can help with this, as I don't know what to do any more.
My problem is that I am trying to use the XML Signature as hash value
for XML documents.
First I create a Signature like this (I left some things out, to shorten
it):
// get DOM tree
Document doc = new Document((Element) root.detach());
// compute XML signature for in
DOMOutputter output = new DOMOutputter();
org.w3c.dom.Document domDoc = output.output(doc);
// create signature object and set its Reference
XMLSignature sig = new XMLSignature(domDoc, "",
XMLSignature.ALGO_ID_SIGNATURE_DSA);
sig.addDocument("");
//get the private key for signing.
sig.addKeyInfo(cert);
sig.addKeyInfo(cert.getPublicKey());
sig.sign(privateKey);
// re-convert to JDOM
org.w3c.dom.Element sigElem = sig.getElement();
DOMBuilder builder = new DOMBuilder();
out = builder.build(sigElem);
I write the signature element to a file (for testing).
Then I try to validate like that:
//doc is the original XML document
org.w3c.dom.Document doc = output.output(new Document((Element)
root.detach()));
//the XML Signature doc:
org.w3c.dom.Document sigDoc = output.output(new Document((Element)
signature.detach()));
//make a signature object from the signature element
XMLSignature sig = new XMLSignature(sigDoc.getDocumentElement(), "");
//My custom resolver, which will just return the doc as
XMLSignatureInput:
NullURIResolver docResolver = new NullURIResolver(doc);
sig.addResourceResolver(docResolver);
KeyInfo ki = sig.getKeyInfo();
X509Certificate cert = ki.getX509Certificate();
valid = sig.checkSignatureValue(cert);
My NullURIResolver looks like this:
public NullURIResolver(Document dataInput)
{
this.dataInput = dataInput;
}
public XMLSignatureInput engineResolve(Attr uri, String BaseURI) throws
ResourceResolverException
{
XMLSignatureInput result = null;
if(this.dataInput != null)
{
result = new XMLSignatureInput(this.dataInput);
result.setMIMEType("text/xml");
result.setSourceURI("");
}
else
{
Object exArgs[] = {"no data to resolve"};
throw new ResourceResolverException("empty", exArgs, uri, BaseURI);
}
return result;
}
As I see it, this will ignore the uri and just return the
XMLSignatureInput from the doc, it was given before.
Some how this won't validate.
Best regards,
Max
--
Maximilian Hütter
blue elephant systems GmbH
Wollgrasweg 49
D-70599 Stuttgart
Tel : (+49) 0711 - 45 10 17 578
Fax : (+49) 0711 - 45 10 17 573
e-mail : max.huetter@blue-elephant-systems.com
Sitz : Stuttgart, Amtsgericht Stuttgart, HRB 24106
Geschäftsführer: Joachim Hörnle, Thomas Gentsch, Holger Dietrich
Re: Problem with verfiying Signature
Posted by Maximilian Hütter <mh...@blue-elephant-systems.com>.
Sean Mullan schrieb:
> Make sure you implement the engineCanResolve method so that it returns
> true for the URIs that your ResourceResolver supports. Your
> implementation will not be used unless the engineCanResolve method
> returns true.
>
> --Sean
Thank you for the answer, I implemented the Resolver with an
engineCanResolve method that always returns true. It didn't work
however. I think it was something with the references, as I used an
empty Reference-element but the logger always showed URI = "".
Anyway, as I am only interested in the canonicalization to compute a
checksum, I gave up on the complete XML-Signature and I am now using
only the Canonicalizer20010315OmitComments and than compute a
MD5-checksum on it.
I am still having problems with this, but maybe I don't understand the
Canonical XML Recommendation correctly. I understood, that the
Canonicalizer should also removed all whitespace outside of
text-elements. That doesn't seem to be the case.
Best regards,
Max
--
Maximilian Hütter
blue elephant systems GmbH
Wollgrasweg 49
D-70599 Stuttgart
Tel : (+49) 0711 - 45 10 17 578
Fax : (+49) 0711 - 45 10 17 573
e-mail : max.huetter@blue-elephant-systems.com
Sitz : Stuttgart, Amtsgericht Stuttgart, HRB 24106
Geschäftsführer: Joachim Hörnle, Thomas Gentsch, Holger Dietrich
Re: Problem with verfiying Signature
Posted by Sean Mullan <Se...@Sun.COM>.
Make sure you implement the engineCanResolve method so that it returns
true for the URIs that your ResourceResolver supports. Your
implementation will not be used unless the engineCanResolve method
returns true.
--Sean
Maximilian Hütter wrote:
> Hi all,
>
> I hope somebody can help with this, as I don't know what to do any more.
> My problem is that I am trying to use the XML Signature as hash value
> for XML documents.
>
> First I create a Signature like this (I left some things out, to shorten
> it):
>
> // get DOM tree
> Document doc = new Document((Element) root.detach());
> // compute XML signature for in
> DOMOutputter output = new DOMOutputter();
> org.w3c.dom.Document domDoc = output.output(doc);
>
> // create signature object and set its Reference
> XMLSignature sig = new XMLSignature(domDoc, "",
> XMLSignature.ALGO_ID_SIGNATURE_DSA);
> sig.addDocument("");
>
> //get the private key for signing.
>
> sig.addKeyInfo(cert);
> sig.addKeyInfo(cert.getPublicKey());
> sig.sign(privateKey);
>
> // re-convert to JDOM
> org.w3c.dom.Element sigElem = sig.getElement();
> DOMBuilder builder = new DOMBuilder();
> out = builder.build(sigElem);
>
> I write the signature element to a file (for testing).
>
> Then I try to validate like that:
> //doc is the original XML document
> org.w3c.dom.Document doc = output.output(new Document((Element)
> root.detach()));
> //the XML Signature doc:
> org.w3c.dom.Document sigDoc = output.output(new Document((Element)
> signature.detach()));
>
> //make a signature object from the signature element
> XMLSignature sig = new XMLSignature(sigDoc.getDocumentElement(), "");
> //My custom resolver, which will just return the doc as
> XMLSignatureInput:
> NullURIResolver docResolver = new NullURIResolver(doc);
> sig.addResourceResolver(docResolver);
> KeyInfo ki = sig.getKeyInfo();
>
> X509Certificate cert = ki.getX509Certificate();
>
> valid = sig.checkSignatureValue(cert);
>
> My NullURIResolver looks like this:
>
> public NullURIResolver(Document dataInput)
> {
> this.dataInput = dataInput;
> }
>
> public XMLSignatureInput engineResolve(Attr uri, String BaseURI) throws
> ResourceResolverException
> {
> XMLSignatureInput result = null;
>
> if(this.dataInput != null)
> {
> result = new XMLSignatureInput(this.dataInput);
> result.setMIMEType("text/xml");
> result.setSourceURI("");
> }
> else
> {
> Object exArgs[] = {"no data to resolve"};
>
> throw new ResourceResolverException("empty", exArgs, uri, BaseURI);
> }
>
> return result;
> }
>
> As I see it, this will ignore the uri and just return the
> XMLSignatureInput from the doc, it was given before.
>
> Some how this won't validate.
>
> Best regards,
>
> Max
>