Generate an Enveloping XML Signature
An enveloping XML signature signs data that is inside the <Signature> element itself.
Developing an enveloping XML signature is also pretty much the same as on Page 2. In this case, however, the URI passed to the Reference object must indicate data inside the <Signature> object. Listing 5 shows an application that proves an enveloping XML signature.
<?xml version="1.0" encoding="UTF-8" standalone=
"no"?><Signature xmlns=
"http://www.w3.org/2000/09/xmldsig#">
<SignedInfo><CanonicalizationMethod Algorithm=
"http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm=
"http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#object"><DigestMethod Algorithm=
"http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>y85+7ckjeb4JvGJnD81UiTLh1k8=</DigestValue>
</Reference></SignedInfo><SignatureValue>
Isi06fnZ69O4kMOMwfI6lq2MWO5GFZU8hb77Bs9VRf6HjbhP+HuJ7peYzwus03eLSFEgy/4wwcua
Ge3kt92uCA==
</SignatureValue><KeyInfo><KeyValue>
<RSAKeyValue><Modulus>
kvoOQ/jfN0hGlxYjn9uZ0LwUL5DF2v2ayAUg3P/DwhO0T/8MvYeynNoTC0zHj+518Slo2XFk8TFW
4BYZdcTraw==</Modulus><Exponent>AQAB</Exponent>
</RSAKeyValue></KeyValue></KeyInfo>
<Object Id="object">This is a text node...
</Object></Signature>
Validate an XML Signature
To validate an XML signature, follow these steps:
- Find the
<Signature> Element: A common way to do this is to use DOM to extract the corresponding Document object and then call the getElementsByTagNameNS method.
- Create a
DOMValidateContext Object: First, obtain a KeySelector object. Next, pass the KeySelector and a reference to the <Signature> element to the DOMValidateContext constructor.
- Unmarshal the Signature: Call the
XMLSignatureFactory.unmarshalXMLSignature method and pass to it the DOMValidateContext object.
- Validate the Signature: Call the
XMLSignature.validate method by passing to it the DOMValidateContext instance. This method will return the success/insuccess of the validation process into a boolean value.
Step 2 mentions the KeySelector object. You need to know that KeySelector is an abstract class used for finding a key using the data managed by a KeyInfo object. Implementing this class isn't easy and there are many methods of doing so, depending on your needs. Listing 6 and Listing 7 demonstrate two simple implementations of this class.
Note: In order to preserve the content of your data, enable the reference caching for DOMValidateContext. To do this, set the javax.xml.crypto.dsig.cacheReference property to Boolean.TRUE. The content of data may be altered by transforms before it is signed. |
Listing 6, ValidateXMLSignature.java, is applicable to XML signatures generated by using the KeyPairGenerator class.
Listing 7, ValidateXMLSignatureCertificate.java is applicable to XML signatures generated by using X509 certificates (do not use this example in production without making it more secure).
What You Need to Get Started
By studying these examples, you can gain enough knowledge to not only develop a skeleton for an application based on XML signatures, but also to generate and validate those signatures. Of course, to create a commercial application that's ready to deal with all the possible security problems, you'll need to get deeper into this API and its possibilities.
| Home / Articles
/ Tighten Data Security with the Java XML Digital Signature API / 1 / 2 / 3 / 4 / |
New on the Java Boutique:
New Review:
Time Management Made Easy with the Quartz Enterprise Job Scheduler
Why not just use the Java timer API? This open source scheduling
API boasts simplicity, ease-of-integration, a well-rounded feature
set, and it's free!
New Applet:
Reverse Complement
Reverse Complement is a simple applet that converts DNA or RNA
sequences into three useful formats.
Elsewhere on internet.com:
WebDeveloper Java
Lots of Java information on webdeveloper.com
WDVL Java
Thorough Java resource at the Web Developer's Virtual Library.
ScriptSearch Java
Hundreds of free Java code files to download.
jGuru: Your View of the Java Universe
Customizable portal with online training, FAQs, regular news updates, and tutorials.
| 
