how to use a special Signature Algorithm (rsa-sha512) or DigestMethod (sha512)
Lars Walther <[email protected]> Sat, 2 Feb 2019 14:30:41 +0100
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <[email protected]> |
--===============0707926132==
Content-Type: multipart/alternative;
boundary="Apple-Mail=_506E26BE-A114-4692-8EE1-AC2EE3C6737A"
--Apple-Mail=_506E26BE-A114-4692-8EE1-AC2EE3C6737A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Hi, unfortunately I=E2=80=99m a newbie in signature and cryptograhical =
staff. Im not sure about the used signature algorithm..
At first I read the documenation of xmlsec and created a xml file to =
sign:
<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<Request xmlns=3D"http://uvbus.dguv.de/datatypes/v1">
<SenderID>kuvb.de</SenderID>
<TimeStamp>2019-02-02T13:49:14.005120+01:00</TimeStamp>
<Procedure>http://www.x-uv.de/fachverfahren/ozgua/v1</Procedure>
<Signature xmlns=3D"http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod =
Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod =
Algorithm=3D"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
<Reference>
<Transforms>
<Transform =
Algorithm=3D"http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<Transform =
Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod =
Algorithm=3D"http://www.w3.org/2001/04/xmlenc#sha512"/>
<DigestValue />
</Reference>
</SignedInfo>
<SignatureValue />
<KeyInfo>
<X509Data />
</KeyInfo>
</Signature>
</Request>
After this I signed the file with the following command:
xmlsec1 --sign --privkey-pem =
kuvbkey.pem,kuvbcert.pem,subca01.pem,interca01.pem,cnuvroot.pem --output =
uvsigned.xml mytosign.xml
=E2=80=A6 and after this I verified the file successfully with the =
following command:
xmlsec1 --verify --trusted-pem cnuvroot.pem uvsigned.xml
OK
SignedInfo References (ok/all): 1/1
Manifests References (ok/all): 0/0
Now my Question: If I send the file in payload of an Webservice-Call I =
get an error from Server-side that the server isn=E2=80=99t able to =
verify my signature. All hints I got was:
Are you sure, that you use the correct Algorithm for sign the XML?? - no =
I=E2=80=99m not! Therfore my Questions:
How can I check which SignatureAlgorithm or DigestMethod was used to =
sign my XML-File?
All Example Files I found had SHA1 as SignatureAlgorithm...
What I have to do if I want to use explizit another SignatureAlgorithm =
then sha1. In my case I have to use rsa-sha512?
...and what I have to do if I want to use another DigestMethod - in my =
case sha512?
I cannot believe that it is enough to set other URL=E2=80=99s in the =
XML-Template..?? Or its determined through the Key-File that I use to =
sign the XML??
Thanks for any Hint
--Apple-Mail=_506E26BE-A114-4692-8EE1-AC2EE3C6737A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><div =
class=3D"">Hi, unfortunately I=E2=80=99m a newbie in signature and =
cryptograhical staff. Im not sure about the used signature =
algorithm..</div><div class=3D""><br class=3D""></div><div class=3D"">At =
first I read the documenation of xmlsec and created a xml file to =
sign:</div><div class=3D""><br class=3D""></div><div class=3D""><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""><?xml =
version=3D"1.0" encoding=3D"UTF-8"?></span></div><div style=3D"margin: =
0px; font-stretch: normal; font-size: 11px; line-height: normal; =
font-family: Menlo;" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D""><Request xmlns=3D"<a =
href=3D"http://uvbus.dguv.de/datatypes/v1" =
class=3D"">http://uvbus.dguv.de/datatypes/v1</a>"></span></div><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<SenderID><a href=3D"http://kuvb.de" =
class=3D"">kuvb.de</a></SenderID></span></div><div style=3D"margin: =
0px; font-stretch: normal; font-size: 11px; line-height: normal; =
font-family: Menlo;" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D""> =
<TimeStamp>2019-02-02T13:49:14.005120+01:00</TimeStamp></span>=
</div><div style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<Procedure><a =
href=3D"http://www.x-uv.de/fachverfahren/ozgua/v1</Procedure>" =
class=3D"">http://www.x-uv.de/fachverfahren/ozgua/v1</Procedure></a>=
</span></div><div style=3D"margin: 0px; font-stretch: normal; font-size: =
11px; line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<Signature xmlns=3D"<a =
href=3D"http://www.w3.org/2000/09/xmldsig" =
class=3D"">http://www.w3.org/2000/09/xmldsig</a>#"></span></div><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<SignedInfo></span></div><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<CanonicalizationMethod =
Algorithm=3D"<a href=3D"http://www.w3.org/2001/10/xml-exc-c14n" =
class=3D"">http://www.w3.org/2001/10/xml-exc-c14n</a>#"/></span></div><=
div style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<SignatureMethod Algorithm=3D"<a =
href=3D"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" =
class=3D"">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a>"/></sp=
an></div><div style=3D"margin: 0px; font-stretch: normal; font-size: =
11px; line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<Reference></span></div><div =
style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
=
<Transforms></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
<Transform Algorithm=3D"<a =
href=3D"http://www.w3.org/2000/09/xmldsig#enveloped-signature" =
class=3D"">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/>=
</span></div><div style=3D"margin: 0px; font-stretch: normal; font-size: =
11px; line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<Transform =
Algorithm=3D"<a href=3D"http://www.w3.org/2001/10/xml-exc-c14n" =
class=3D"">http://www.w3.org/2001/10/xml-exc-c14n</a>#"/></span></div><=
div style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
=
</Transforms></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
<DigestMethod Algorithm=3D"<a =
href=3D"http://www.w3.org/2001/04/xmlenc#sha512" =
class=3D"">http://www.w3.org/2001/04/xmlenc#sha512</a>"/></span></div><=
div style=3D"margin: 0px; font-stretch: normal; font-size: 11px; =
line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D""> =
<DigestValue =
/></span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
</Reference></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
</SignedInfo></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> <SignatureValue =
/></span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
<KeyInfo></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> <X509Data =
/></span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
</KeyInfo></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""> =
</Signature></span></div><div style=3D"margin: 0px; font-stretch: =
normal; font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""></Request></span></div></div><div class=3D""><br =
class=3D""></div><div class=3D"">After this I signed the file with the =
following command:</div><div class=3D""><br class=3D""></div><div =
class=3D""><div style=3D"margin: 0px; font-stretch: normal; font-size: =
11px; line-height: normal; font-family: Menlo;" class=3D""><span =
style=3D"font-variant-ligatures: no-common-ligatures" class=3D"">xmlsec1 =
--sign --privkey-pem =
kuvbkey.pem,kuvbcert.pem,subca01.pem,interca01.pem,cnuvroot.pem --output =
uvsigned.xml mytosign.xml</span></div></div><div class=3D""><br =
class=3D""></div><div class=3D"">=E2=80=A6 and after this I verified the =
file successfully with the following command:</div><div class=3D""><br =
class=3D""></div><div class=3D""><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 11px; line-height: normal; font-family: =
Menlo;" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">xmlsec1 --verify --trusted-pem =
cnuvroot.pem uvsigned.xml</span></div><div style=3D"margin: 0px; =
font-stretch: normal; font-size: 11px; line-height: normal; font-family: =
Menlo;" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">OK</span></div><div style=3D"margin: =
0px; font-stretch: normal; font-size: 11px; line-height: normal; =
font-family: Menlo;" class=3D""><span style=3D"font-variant-ligatures: =
no-common-ligatures" class=3D"">SignedInfo References (ok/all): =
1/1</span></div><div style=3D"margin: 0px; font-stretch: normal; =
font-size: 11px; line-height: normal; font-family: Menlo;" =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D"">Manifests References (ok/all): 0/0</span></div></div><div =
class=3D""><span style=3D"font-variant-ligatures: no-common-ligatures" =
class=3D""><br class=3D""></span></div><div class=3D""><br =
class=3D""></div><div class=3D"">Now my Question: If I send the file in =
payload of an Webservice-Call I get an error from Server-side that the =
server isn=E2=80=99t able to verify my signature. All hints I got =
was:</div><div class=3D""><br class=3D""></div><div class=3D"">Are you =
sure, that you use the correct Algorithm for sign the XML?? - no I=E2=80=99=
m not! Therfore my Questions:</div><div class=3D""><br =
class=3D""></div><div class=3D"">How can I check which =
SignatureAlgorithm or DigestMethod was used to sign my =
XML-File?</div><div class=3D""><br class=3D""></div><div class=3D"">All =
Example Files I found had SHA1 as SignatureAlgorithm...</div><ul =
class=3D""><li class=3D"">What I have to do if I want to use explizit =
another SignatureAlgorithm then sha1. In my case I have to use =
rsa-sha512?</li><li class=3D"">...and what I have to do if I want to use =
another DigestMethod - in my case sha512?</li></ul><div class=3D"">I =
cannot believe that it is enough to set other URL=E2=80=99s in the =
XML-Template..?? Or its determined through the Key-File that I use to =
sign the XML??</div><div class=3D""><br class=3D""></div><div =
class=3D"">Thanks for any Hint</div><div class=3D""><br =
class=3D""></div></body></html>=
--Apple-Mail=_506E26BE-A114-4692-8EE1-AC2EE3C6737A--
--===============0707926132==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h
aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls
bWFuL2xpc3RpbmZvL3htbHNlYwo=
--===============0707926132==--