Pascal (Lazarus/Delphi)

Create XML Digital Signature using a ECDSA Key

See more XML Digital Signatures Examples

Demonstrates how to create an XML digital signature using a ECDSA key.

This example requires Chilkat v9.5.0.69 or greater.

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Http,
  Chilkat.StringBuilder,
  Chilkat.PrivateKey,
  Chilkat.XmlDSigGen,
  Chilkat.XmlDSig;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  url: string;
  http: THttp;
  sbSoapXml: TStringBuilder;
  ecKey: TPrivateKey;
  xmlSigGen: TXmlDSigGen;
  verifier: TXmlDSig;
  bVerified: Boolean;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  The SOAP XML to be signed in this example contains the following:

  //  <?xml version="1.0" encoding="UTF-8" standalone="no" ?>
  //  <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  //      <SOAP-ENV:Header>
  //          <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"></wsse:Security>
  //      </SOAP-ENV:Header>
  //      <SOAP-ENV:Body xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" SOAP-SEC:id="Body">
  //          <z:FooBar xmlns:z="http://example.com" />
  //      </SOAP-ENV:Body>
  //  </SOAP-ENV:Envelope>
  //  

  //  The above XML is available at https://www.chilkatsoft.com/exampleData/soapToSign.xml
  //  Fetch the XML and then sign it..

  url := 'https://www.chilkatsoft.com/exampleData/soapToSign.xml';
  http := THttp.Create;
  sbSoapXml := TStringBuilder.Create;
  success := http.QuickGetSb(url,sbSoapXml);
  if (success <> True) then
    begin
      WriteLn(http.LastErrorText);
      Exit;
    end;

  //  This example uses an ECDSA private key for signing.  
  //  There are many ways to load an ECDSA private key using Chilkat.  This example
  //  will load from an unencrypted PEM file.

  //  For your convenience, Chilkat put this sample ECDSA PEM here:  https://www.chilkatsoft.com/exampleData/secp256r1-key.zip
  ecKey := TPrivateKey.Create;
  success := ecKey.LoadPemFile('qa_data/ecc/secp256r1-key.pem');
  if (success <> True) then
    begin
      WriteLn(ecKey.LastErrorText);
      Exit;
    end;

  //  To create the XML digital signature (i.e. embed the signature within
  //  the SOAP XML), we specify what is desired, and then call the method to 
  //  create the XML signature.
  //  
  //  For example, the application must provide the following:
  //      - Where to put the signature.
  //      - What to sign.
  //      - The algorithms to be used.
  //      - The key to be used for signing.
  //  

  xmlSigGen := TXmlDSigGen.Create;

  //  In this example, the Signature will be placed within the wsse:Security element.
  //  To specify the location, set the SigLocation property to the XML path to this element,
  //  using vertical bar characters to separate tags.
  xmlSigGen.SigLocation := 'SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security';

  //  An XML digital signature contains one or more references.  A given reference
  //  can be a same-document reference (to an XML fragment), or an external reference.
  //  This example will add a single same-document reference.  We'll add a reference to the XML fragment
  //  at SOAP-ENV:Body, which is indicated by providing the value of the "Id" attribute (where "Id" is case
  //  insensitive).  For each same-document reference, we must also indicate the hash algorithm and XML canonicalization
  //  algorithm to be used.  For this example we'll choose SHA-256 and Exclusive XML Canonicalization.
  xmlSigGen.AddSameDocRef('Body','sha256','EXCL_C14N','','');

  //  Let's provide the ECDSA key to be used for signing:
  xmlSigGen.SetPrivateKey(ecKey);

  //  We're leaving the following properties at their default values:
  //  
  //     - SigNamespacePrefix (default is "ds")
  //     - SignedInfoCanonAlg  (default is EXCL_C14N)
  //     - SignedInfoDigestMethod (default is sha256)
  //     - KeyInfoType (default is "KeyValue", where the ECDSA public key is included in the Signature)

  //  Note: Each Reference specifies its own algorithms for XML canonicalization and hashing.
  //  The SignedInfo part also has specified hash and canonicalization algorithms, which may be different
  //  than the algorithms used in the References.
  //  In this example, we use Exclusive XML Canonicalization and SHA-256 throughout.

  //  Finally, we're going to set one property that's optional, but commonly used.
  //  It's the SignedInfoPrefixList.  In this case, we're using Exclusive Canonicalization, and the signature
  //  will be placed in a location within the XML document where namespace prefixes are used in the ancestors.
  //  Specifically, the "wsse" and "SOAP-ENV" namespace prefixes are used.
  xmlSigGen.SignedInfoPrefixList := 'wsse SOAP-ENV';

  //  OK, everything's specified, so let's create the XML digital signature:
  //  This in-place signs the XML.  If successful, sbSoapXml will contain the 
  //  XML with the digital signature at the specified location.
  success := xmlSigGen.CreateXmlDSigSb(sbSoapXml);
  if (success <> True) then
    begin
      WriteLn(xmlSigGen.LastErrorText);
      Exit;
    end;

  //  Examine the signed SOAP XML:
  WriteLn(sbSoapXml.GetAsString());

  //  This is the signed SOAP XML.
  //  Chilkat emits the Signature in compact form on a single line.  Whitespace in XML signatures
  //  matters.  Chilkat's opinion is that writing the Signature without whitespace minimizes the chance
  //  for problems with whatever software might be verifying the signature.

  //  <?xml version="1.0" encoding="UTF-8" standalone="no" ?>
  //  <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  //      <SOAP-ENV:Header>
  //          <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse SOAP-ENV"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/><ds:Reference URI="#Body"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>OwgHPZNfDkXnZsjpfzXqAcT3RV3HzmTsEy2bP44FJ0M=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>jmPSGgtirHSjjcs/o0NIDwwvy4aFBCEosSN+XP5NLVuGpRYnS2EM7mItiw6TKmESAoJYV23ZN4pZ9BFRKSvZqw==</ds:SignatureValue><ds:KeyInfo><ds:KeyValue><ds:ECKeyValue xmlns="http://www.w3.org/2009/xmldsig11#"><ds:NamedCurve URI="urn:oid:1.2.840.10045.3.1.7" /><ds:PublicKey>BOVKaiLPKEDChhkA64UEBOXTv/VFHnhrUPN+bXqCvEl7rroAYpH5tKzbiGTtMSlp4JO9Pxg44zeX7EoWDvOrpD0=</ds:PublicKey></ds:ECKeyValue></ds:KeyValue></ds:KeyInfo></ds:Signature></wsse:Security>
  //      </SOAP-ENV:Header>
  //      <SOAP-ENV:Body xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" SOAP-SEC:id="Body">
  //          <z:FooBar xmlns:z="http://example.com" />
  //      </SOAP-ENV:Body>
  //  </SOAP-ENV:Envelope>

  //  The above signed XML contains the ECDSA public key in the ECKeyValue fragment (within the ds:KeyInfo).
  //  The signature can easily be verified like this:

  verifier := TXmlDSig.Create;

  //  First load the XML containing the signature(s) to be verified.
  success := verifier.LoadSignatureSb(sbSoapXml);
  if (success <> True) then
    begin
      WriteLn(verifier.LastErrorText);
      Exit;
    end;

  bVerified := verifier.VerifySignature(True);
  if (bVerified <> True) then
    begin
      WriteLn(verifier.LastErrorText);
    end;
  WriteLn('Signature verified = ' + bVerified);


  http.Free;
  sbSoapXml.Free;
  ecKey.Free;
  xmlSigGen.Free;
  verifier.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.