santuario-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 40245] New: - Version 1.4 doesn't sign XML document correctly (bad digest)
Date Mon, 14 Aug 2006 08:03:11 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40245>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=40245

           Summary: Version 1.4 doesn't sign XML document correctly (bad
                    digest)
           Product: Security
           Version: unspecified
          Platform: Other
        OS/Version: Windows XP
            Status: NEW
          Severity: critical
          Priority: P2
         Component: Signature
        AssignedTo: security-dev@xml.apache.org
        ReportedBy: yvan.hess@imtf.ch


XML security version 1.4 Beta0 and Beta1 don't sign the XML document correctly.

Two tests failed:

TEST 1: The XML document is already signed (with XML security version 1.2) and 
it is verified with the version 1.4 (beta0 and beta1).This test failed using 
version 1.4 but was ok with precedent versions.

TEST 2: The XML document is signed with XML security V1.4Beta1 and is verified 
with IBM XSS4J toolkit.This test failed using version 1.4Beta1 but was ok with 
precedent versions.

Doing some investigations, it seems that the problem is due to a bug into 
xpath2 filter that has been rewritten in the version 1.4. 

As you can see I am signing (see bellow) one part of the XML document and two 
external binary documents. The problem seems to come from the first Reference 
(<ds:Reference URI="">). The digest value doesn't match after signature 
verification. The digest values of the two external references matches.

<edoc:SignatureBlock id="Revision-1-Signature-1">
   <edoc:SignatureDate>2006-08-07T12:24:18</edoc:SignatureDate>
   <edoc:Signer>Hess Yvan (first signature)</edoc:Signer>
   <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
         <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-
xml-c14n-20010315"/>
         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-
sha1"/>
         <ds:Reference URI="">
            <ds:Transforms>
               <ds:Transform Algorithm="http://www.w3.org/2002/06/xmldsig-
filter2">
                  <dsig-xpath:XPath xmlns:dsig-
xpath="http://www.w3.org/2002/06/xmldsig-filter2" 
Filter="intersect">/edoc:EDOC/edoc:Object</dsig-xpath:XPath>
               </ds:Transform>
            </ds:Transforms>
            <ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>2jmj7l5rSw0yVb/vlWAYkK/YBwk=</ds:DigestValue>
         </ds:Reference>
         <ds:Reference URI="urn:hypersuite:8F1F8E64-C0A8024E0160C4B0-A0033464">
            <ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>7typFfsZFzJVtEsGinu58N8RtqE=</ds:DigestValue>
         </ds:Reference>
         <ds:Reference URI="urn:hypersuite:8F1F8E64-C0A8024E0160C4B0-A0033465">
            <ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>oxwjv1Go+8Y0m97hiJLTKcYx4t8=</ds:DigestValue>
         </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>
          
RYaOiVt2gDIFmFDFotJrxGWHFYFe3dAoI1L2vubdlbBZt3pk4aaolBz6NA9IswW9ZOwPGYizLB4PvMa
8f4sHx8onoVt+5BGQwLuTYRDgGrJqmwpbwJxUAPvFh1xgED
          
GodfZ4P7kmjsvMa8f4sHx8onoVt+govMa8f4sHx8onoVt+4fvMa8f4sHx8onoVt+jDvMa8f4sHx8ono
Vt+ULvMa8f4sHx8onoVt+dk9ZhwvIN/+eBfirtyCcbTb1w=
      </ds:SignatureValue>
      <ds:KeyInfo>
        <ds:X509Data>
           
<ds:X509Certificate>MIIDADCCAmmgAwIBAgIGAQpEtx7tMA0GCSqGSIb3DQEBBQUAMIGXMRQwEgY
DVQQG.....</ds:X509Certificate>
           
<ds:X509Certificate>MIICpDCCAg0CBgEKRLVqKDANBgkqhkiG9w0BAQUFADCBlzEUMBIGA1UEBhM
LU3dpdHplcmxhbmQx....</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
   </ds:Signature>
</edoc:SignatureBlock>

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

Mime
View raw message