Mailing-List: contact dev-help@santuario.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@santuario.apache.org
From: Hugo Trippaers <trippie@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 10.0 \(3226\))
Subject: Question on specific document requirements
Message-Id: <56B988B8-75F3-478B-A495-9CD31E77DB8E@gmail.com>
Date: Wed, 12 Oct 2016 22:55:57 +0200
To: dev@santuario.apache.org
archived-at: Wed, 12 Oct 2016 20:56:03 -0000

Hey folks,

Hope this is the right place to ask this, but i=E2=80=99m working on an =
interface to a system with some specific requirements i haven=E2=80=99t =
figured out yet. I=E2=80=99ve got some of them covered so far (they use =
KeyName as key identifier for example), but i have a few remaining =
things i need to solve and i would like to know if those are possible to =
configure with the current version of the santuario library.

First of all their implementation expects the signature element to be =
the last element in the resulting xml document. See the example below, =
can this be done with a configuration?

<xml..>
<root>
  <payload>=E2=80=A6.</payload>
  <Signature>=E2=80=A6</Signature>
</root>

Second they don=E2=80=99t accept Ids in the root and signature element =
and expect the Reference URI to be an empty string.

And they also seem to take offence at the '<dsig:Transform =
Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#" />=E2=80=99 =
transform being present.

Below it the complete signature as generated by my current =
configuration.=20

If using the library indirectly from the CXF XmlSecOutInterceptor with =
the following configuration:

final SignatureProperties properties =3D new SignatureProperties();

/* 1. The entire XML message must be signed.
/* 2. For the purpose of generating the digest of the main message, the =
inclusive canonicalization algorithm must be used.
/* 3. For the purpose of generating the signature value, the exclusive =
canonicalization algorithm must be used.
 */
properties.setSignatureC14nMethod(XMLSecurityConstants.NS_C14N_EXCL);

/* 4. The syntax for an enveloped signature must be used.
 * 5. For hashing purposes the SHA256 algorithm must be used.
 */
properties.setSignatureDigestAlgo(XMLSecurityConstants.NS_XENC_SHA256);

/* 6. For signature purposes the RSAWithSHA256 algorithm must be used. =
RSA keys must be 2,048 bits long.
 */
properties.setSignatureAlgo(XMLSecurityConstants.NS_XMLDSIG_RSASHA256);

/* 7. The public key must be referenced using a fingerprint of an X.509 =
certificate. The fingerprint must be
 * calculated according to the following formula HEX(SHA-1(DER =
certificate)).
 */
properties.setSignatureKeyIdType("KeyName");


Looking for some pointer to get this done, if it is configuration that =
would be great. If this needs some modifications in the code i would be =
happy with some pointers in the right direction.

Thanks!

Hugo


  <dsig:Signature xmlns:dsig=3D"http://www.w3.org/2000/09/xmldsig#" =
Id=3D"G1345d174-e9d2-4a6f-b573-8b750773b2ee">
    <dsig:SignedInfo>
      <dsig:CanonicalizationMethod =
Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#" />
      <dsig:SignatureMethod =
Algorithm=3D"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
      <dsig:Reference URI=3D"#G0f49a5bd-86ed-4e12-8146-57f584a5f6c1">
        <dsig:Transforms>
          <dsig:Transform =
Algorithm=3D"http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <dsig:Transform =
Algorithm=3D"http://www.w3.org/2001/10/xml-exc-c14n#" />
        </dsig:Transforms>
        <dsig:DigestMethod =
Algorithm=3D"http://www.w3.org/2001/04/xmlenc#sha256" />
        =
<dsig:DigestValue>AtXiXRQ7sLparlwtp9PwFcUmdzR8XsJenVNxy3Ulue4=3D</dsig:Dig=
estValue>
      </dsig:Reference>
    </dsig:SignedInfo>
    =
<dsig:SignatureValue>I+qG/S2HV+1c9a6quuH15cooZHslLG+GlyWgvnzn83DYGh6tgG4c2=
sKgUMy3OuES3raw8dczf02Q
=
THvwztwoMl7136Ca2M9/Qyc/BRhW7fVoMqMzkppHcTtFFB/V7Q3D9k8VquqdPuGwFb+rPSgQfd=
xe
=
owB00/OGt5eXcMcpLERvbK6t9iRbg6ykLBGgc0VLQSYbxcA4FgBe1RTOFbuUadq9Nz4qVxXmZy=
TY
=
rH/kdmOIvsL1yrCmhQ2EqVw8XalNVBoamu2T3WCxPWDSvZrvJ0Hf7bp0K6hd/aF7vRwaYzklDA=
0Z
F1XAUMctYXnBNFc5yjeyrCEGiEmkLYsafcP3AQ=3D=3D
</dsig:SignatureValue>
    <dsig:KeyInfo Id=3D"Gf05095c8-a7ea-47bb-8d68-80f5481ea9e3">
      =
<dsig:KeyName>B1E1820D3DC7D8E57F80AF11B968749380A5D1EB</dsig:KeyName>
    </dsig:KeyInfo>
  </dsig:Signature>