Question

What is a correct way of implementing Enveloping and Detached Signatures using Apache XML Security Library (xsec) version 3.1.1?

I was searching for some good examples but couldn't find any. The apache website too has listed an example, but it is for creating Enveloped Signatures only.

Was it helpful?

Solution

I found the solution to be very simple.

Once the document has been parsed, the following will generate an Enveloped Signature (as specified here):

// rootelem contains the root element of the parsed document
XSECProvider    prov;
DSIGSignature * sig;
DOMElement    * sigNode;

sig = prov.newSignature();
sigNode = sig->createBlankSignature(xercescdom, CANON_C14N_COM, SIGNATURE_HMAC, HASH_SHA1);

// append the signature node to the document's element which is being signed, here
// it is the root element
rootelem->appendChild(xercescdom->createTextNode(MAKE_UNICODE_STRING("\n")));
rootelem->appendChild(sigNode);
rootelem->appendChild(xercescdom->createTextNode(MAKE_UNICODE_STRING("\n")));

// create the envelope reference and the signing key (e.g. HMAC Key)
// set the signing key

sig->setSigningKey(hmackey);

// other steps... Serializing the rootelem will generate an XML document with Enveloped Signature

The following will generate an Enveloping Signature:

XSECProvider    prov;
DSIGSignature * sig;
DOMElement    * sigNode;

sig = prov.newSignature();
sigNode = sig->createBlankSignature(xercescdom, CANON_C14N_COM, SIGNATURE_HMAC, HASH_SHA1);

// append an "Object" element to the signature object
DSIGObject * object = sig->appendObject();
// in an enveloping signature, the "Object" element contains the data being signed
// so the rootelem can be appended as a child to this object element
object->appendChild(rootelem);

// AND you are done!
// now create the envelope reference and the signing key (e.g. HMAC Key)
// set the signing key

sig->setSigningKey(hmackey);

// Serializing the signature node (sigNode) will give you the required XML with Enveloping Signature.

Similarly a Detached Signature can be generated with some effort.

The above examples cover very simple cases. A little bit of effort will be required for signing multiple data items and subsets of document.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top