Re: Are XML Signatures secure?

Hello!
You wrote on Sun, 23 Sep 2007 14:26:54 +0200:

NE> I was planning to deploy my control using a digitally signed XML
NE> signature but when I come to think of it nothing prevents a savvy user
NE> from taking the XML file, stripping the Digital signature, altering the
NE> XML document and signing it again with his/her own key.
NE> Am I right? or am I missing something?

The idea of signatures is that they are the evidence of the document origin and document integrity. In other words, the signature can say that the document was signed by certain signer and since signing the document has not beem modified. The signature doesn't prevent altering the data (in generic case).

So when you are talking about signatures, you need to define, what exactly you want to do. If you want to ensure that the component / control can't be cracked, then the signature won't work for you.

If you want to ensure that the component was not modified by the evil hacker, trying to inject his code into the end-user's system, then the end-user must check and ensure that the signature is *yours* (and not the one of the evil hacker).

Validating the signatures is possible when X.509 certificates are employed and included into the signature. If you use plain RSA or DSA key for signing, then the end user must have your public key in order to validate the signature and ensure that it's yours.

With best regards,
Eugene Mayevski
http://www.SecureBlackbox.com - the comprehensive component suite for network security

.

Relevant Pages

  • Re: How to verify CA for a X.509 certificate
    ... There has been a lot of work done around X509 for the 2.0 release of the framework. ... Both XML Encryption and XML Digital Signatures have ... >>> The article DOES check if the public key is in the store, ... >>> to use it to explicitly verify the signature on the cert. ...
    (microsoft.public.dotnet.security)
  • Re: Digitally signing XML files
    ... PrivateKey privateKey, boolean debug) throws WSSecurityException ... //Add SecurityHelper.class header to the SOAP message if it does ... Append the signature element to proper location before signing ... // SOAP XML document, the SOAP body is referenced as a URI ...
    (comp.lang.java.programmer)
  • Re: Digitally signing XML files
    ... There is, W3C has a specification for XML Signatures, see ... You put in a new element called Signature. ... Crypto algorithms typically require their input to be bytes, ... These are easiest to answer with a single word: canonicalization. ...
    (comp.lang.java.programmer)
  • Manually computing sha1 digest of reference containing base64 encoded string and comparing it to dig
    ... The XML has two nodes one which has public part which is not encrypted ... Once I compute the signature I append the signature node to XMLDoc and ... Issue is user says that the digest information of the referenced data ... //Load the node in XMLDoc ...
    (microsoft.public.dotnet.security)
  • Re: secure a WS called via GPRS
    ... I made some tests and I decided to implement a "custom signature based" ... now I pass to my webservice three parameters: ... , the xml command (I decided ...
    (microsoft.public.dotnet.framework.webservices.enhancements)