Xml signature with XPath transform

From: J-P Meunier (fuimens_at_yahoo.fr)
Date: 05/28/03 

Date: Wed, 28 May 2003 16:09:44 +0200

Hello,

I am sorry to insist but I really need to perform a XmlXPathTransform in
order to sign only a part of <Object> Xml element.
For instance I want to sign the <SignedPropertie> node which is included in
<Object>.

For that I create a reference like this:

Reference reference = new Reference();
reference.Uri = "#GeneralProperties";
XmlDsigXPathTransform xPathTransform = new XmlDsigXPathTransform();
string strXPath = "<XPath>//SignedProperties/descendant::*</XPath>";
XmlDocument domTransform = new XmlDocument();
domTransform.LoadXml(strXPath);
xPathTransform.LoadInnerXml(domTransform.ChildNodes);
reference.AddTransform(xPathTransform);

Now when I compute the signature I get the following Xml:

<Signature Id="MySignature" xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
        <CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
        <SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
        <Reference URI="#GeneralProperties">
            <Transforms>
                <Transform
Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
                    <XPath>//SignedProperties/descendant::*</XPath>
                </Transform>
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
/>
            <DigestValue>52dHkEkYtxE0Q5vyOd7FNQHu9/o=</DigestValue>
        </Reference>
    </SignedInfo>
    <SignatureValue>ZL8ikcITRwLQ==</SignatureValue>
    <KeyInfo>
        <KeyValue xmlns="http://www.w3.org/2000/09/xmldsig#">
            <RSAKeyValue>
                <Modulus>x9lJWha9tRVRXq0UnLnkx1EuQ==</Modulus>
                <Exponent>AQAB</Exponent></RSAKeyValue>
        </KeyValue>
    </KeyInfo>
<Object Id="GeneralProperties">
    <QualifyingProperties xmlns="">
        <SignedProperties>
            <SignedSignatureProperties>
                <SigningTime>2003-5-28</SigningTime>
            </SignedSignatureProperties>
        </SignedProperties>
    </QualifyingProperties>
</Object>
</Signature>

To validate that not all <Object> node is signed I change
<QualifyingProperties> tag by another tag name but then the signature check
return false. This means that the XPath transformation didn't work as
expected.

Please provide any information that could help because I can't work it out.

Thanks

JP

Relevant Pages

  • RE: SignedXML.CheckSignature()/CreateSignature() Alternative?
    ... Probably I can create a dummy reference and get the digest values for the ... the signature Value logic... ... and attach this transform to that reference. ... >> Iam using SignedXML.CheckSignaturemethod for validating XMLDSIG ...
    (microsoft.public.dotnet.security)
  • bug in c14n canonicalization ?
    ... I would like to discuss a c14n canonicalization problem here. ... When I try to validate this signature with an other XmlDSig libraries, ... referenced by the first Reference with .NET functions and with Apache ... Apache returns the same node (SignedProperties) but keeps its namespace to ...
    (microsoft.public.dotnet.security)
  • RE: SignedXML.CheckSignature()/CreateSignature() Alternative?
    ... DataObject into the signature containing your MIME data. ... Then add a dummy reference to your ... and attach this transform to that reference. ... > Iam using SignedXML.CheckSignaturemethod for validating XMLDSIG ...
    (microsoft.public.dotnet.security)
  • RE: SignedXML.CheckSignature()/CreateSignature() Alternative?
    ... Right, if you're using a custom URI format, you won't be able to simply ... namespaces, cannonicalization, correctly invoking transform chains, etc. ... > Probably I can create a dummy reference and get the digest values for the ... > just give the Signature Value for the SignedInfo.Anyhow based on what I ...
    (microsoft.public.dotnet.security)
  • Re: URI Reference ID generation - wse / filters
    ... I added the following custom output filter: ... Signature certSignature = new Signature; ... Reference refHeader = new Reference; ... > public override void ProcessMessage ...
    (microsoft.public.dotnet.framework.webservices.enhancements)