enveloped-signature Transform
R Zaghi <[email protected]> Wed, 16 May 2018 22:23:33 +0100
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <CAFLMc5sqe0wVxfhSciQQfgibvoDgOO1pPoBXVuNFERMhOaLrHQ@mail.gmail.com> |
--===============0533041706==
Content-Type: multipart/alternative; boundary="000000000000cfc212056c595490"
--000000000000cfc212056c595490
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi
I am familiarizing myself with XML signatures using XMLSEC and I have found
a few of the standards' definitions slightly confusing.
So I joined here to ask and also to figure out some of the details of how
the library works too.
With regards to "enveloped-signature Transform", how exactly are we
supposed to check the signature?
I found an example on the internet.
Can you please see if my explanations of the overall process are correct
here?
The enveloped XML that we are checking is:
<Envelope xmlns=3D"urn:envelope">
<Signature xmlns=3D"http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm=3D"http://www.w3.org/TR/
2001/REC-xml-c14n-20010315#WithComments"/>
<SignatureMethod Algorithm=3D"http://www.w3.org/2000/09/
xmldsig#dsa-sha1"/>
<Reference URI=3D"">
<Transforms>
<Transform Algorithm=3D"http://www.w3.org/2000/09/xmldsig#envelop=
ed-
signature"/>
</Transforms>
<DigestMethod Algorithm=3D"http://www.w3.org/2000/09/xmldsig#sha1"/=
>
<DigestValue>uooqbWYa5VCqcJCbuymBKqm17vY=3D</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>KedJuTob5gtvYx9qM3k3gm7kbLBwVbEQRl26S2tmXjqNND7MRGtoew=
=3D=3D
</SignatureValue>
</Signature>
</Envelope>
And my understanding of the overall validation process is:
1- First we remove all lines from <Signature> to </Signature>
2- We calculate the hash digest of what is left after applying
all CanonicalizationMethod transformations and using the DigestMethod in
SignedInfo:
<Envelope xmlns=3D"urn:envelope">
</Envelope>
3- If the base64 encoding of this digest matches the specified DigestValue
then we continue and take everything from <SignedInfo> to </SignedInfo> and
apply the CanonicalizationMethod transformations to it.
4- We will calculate the digest of this transformed SignedInfo using
the SignatureMethod hash algorithm
5- Finally we take SignatureValue and decode it using a provided public key
or a provided public certificate to see if the result matches the
calculated result of step (4)
Is this correct in this example?
Ramin Zaghi
*Mosaic3DX=E2=84=A2 | User Interface Technology*
http://linkedin.com/in/raminzaghi
--000000000000cfc212056c595490
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">Hi<div><br></div><div>I am familiarizing myself with XML s=
ignatures using XMLSEC and I have found a few of the standards' definit=
ions slightly confusing.</div><div>So I joined here to ask and also to figu=
re out some of the details of how the library works too.</div><div><br></di=
v><div>With regards to "enveloped-signature Transform", how exact=
ly are we supposed to check the signature?</div><div><br></div><div>I found=
an example on the internet.</div><div>Can you please see if my explanation=
s of the overall process are correct here?</div><div><br></div><div>The env=
eloped XML that we are checking is:</div><div><br></div><div><font face=3D"=
monospace, monospace"><Envelope xmlns=3D"urn:envelope"><br>=
</font></div><div><div><font face=3D"monospace, monospace">=C2=A0 <Signa=
ture xmlns=3D"<a href=3D"http://www.w3.org/2000/09/xmldsig#" target=3D=
"_blank">http://www.w3.org/2000/<wbr>09/xmldsig#</a>"></font></div>=
<div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 <SignedInfo></=
font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =C2=A0 &l=
t;CanonicalizationMethod=C2=A0</font><font face=3D"monospace, monospace">Al=
gori<wbr>thm=3D"<a href=3D"http://www.w3.org/TR/2001/REC-xml-c14n-" ta=
rget=3D"_blank">http://www.w3.org/TR/<wbr>2001/REC-xml-c14n-</a></font><spa=
n style=3D"font-family:monospace,monospace">20010315#<wbr>WithComments"=
;/></span></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =
=C2=A0 <SignatureMethod Algorithm=3D"<a href=3D"http://www.w3.org/2=
000/09/" target=3D"_blank">http://www.w3.org/<wbr>2000/09/</a></font><span =
style=3D"font-family:monospace,monospace">xmldsig#dsa-sha1"/></span=
></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =C2=A0 <Re=
ference URI=3D""></font></div><div><font face=3D"monospace, mo=
nospace">=C2=A0 =C2=A0 =C2=A0 =C2=A0 <Transforms></font></div><div><f=
ont face=3D"monospace, monospace">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Tr=
ansform Algorithm=3D"<a href=3D"http://www.w3.org/2000/09/" target=3D"=
_blank">http://www.w3.org/<wbr>2000/09/</a></font><span style=3D"font-famil=
y:monospace,monospace">xmldsig#enveloped-<wbr>signature"/></span></=
div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =C2=A0 =C2=A0 &l=
t;/Transforms></font></div><div><font face=3D"monospace, monospace">=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 <DigestMethod Algorithm=3D"<a href=3D"http=
://www.w3.org/2000/09/" target=3D"_blank">http://www.w3.org/<wbr>2000/09/</=
a></font><span style=3D"font-family:monospace,monospace">xmldsig#sha1"=
/></span></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 <DigestValue><wbr>uooqbWYa5VCqcJCbuymBKqm17vY=3D</<w=
br>DigestValue></font></div><div><font face=3D"monospace, monospace">=C2=
=A0 =C2=A0 =C2=A0 </Reference></font></div><div><font face=3D"monospa=
ce, monospace">=C2=A0 =C2=A0 </SignedInfo></font></div><div><font fac=
e=3D"monospace, monospace">=C2=A0 =C2=A0 <SignatureValue></font><font=
face=3D"monospace, monospace">KedJuTob5gtvYx<wbr>9qM3k3gm7kbLBwVbEQRl26S2t=
mXjqN<wbr>ND7MRGtoew=3D=3D</font><span style=3D"font-family:monospace,monos=
pace"></SignatureValue></span></div><div><font face=3D"monospace, mon=
ospace">=C2=A0 </Signature></font></div><div><font face=3D"monospace,=
monospace"></Envelope></font></div></div><div><div><div class=3D"gma=
il-m_6094587630291881423gmail_signature"><div dir=3D"ltr"><div dir=3D"ltr">=
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><br></d=
iv><div dir=3D"ltr"><br></div><div>And my understanding of the overall vali=
dation process is:</div><div><br></div><div>1- First we remove all lines fr=
om <Signature> to </Signature></div><div><br></div><div>2- We c=
alculate the hash digest of what is left after applying all=C2=A0Canonicali=
zationMethod transformations and using the DigestMethod in SignedInfo:</div=
><div><div><Envelope xmlns=3D"urn:envelope"></div><div><=
/Envelope><br></div></div><div><br></div><div>3- If the base64 encoding =
of this digest matches the specified=C2=A0DigestValue then we continue and =
take everything from <SignedInfo> to </SignedInfo> and apply th=
e CanonicalizationMethod=C2=A0transformations to it.</div><div><br></div><d=
iv>4- We will calculate the digest of this transformed SignedInfo using the=
=C2=A0SignatureMethod hash algorithm</div><div><br></div><div>5- Finally we=
take=C2=A0SignatureValue and decode it using a provided public key or a pr=
ovided public certificate to see if the result matches the calculated resul=
t of step (4)</div><div dir=3D"ltr"><br></div><div dir=3D"ltr"><br></div><d=
iv>Is this correct in this example?</div><div><br></div><div><br></div><div=
><br></div><div dir=3D"ltr"><br></div><div dir=3D"ltr"><br></div><div dir=
=3D"ltr"><br></div><div dir=3D"ltr">Ramin Zaghi</div><div dir=3D"ltr"><br><=
div><b>Mosaic3DX=E2=84=A2 | <font size=3D"1">User Interface Technology</fon=
t></b></div><div><div style=3D"font-size:small"><a href=3D"http://linkedin.=
com/in/raminzaghi" target=3D"_blank">http://linkedin.com/in/<wbr>raminzaghi=
</a><br></div></div><div><font size=3D"2"><br><br><br></font></div></div></=
div></div></div></div></div></div></div>
<div dir=3D"ltr"><br></div></div></div>
--000000000000cfc212056c595490--
--===============0533041706==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h
aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls
bWFuL2xpc3RpbmZvL3htbHNlYwo=
--===============0533041706==--