Pascal (Lazarus/Delphi)

Verify an XML Signature with Multiple References

See more XML Digital Signatures Examples

Demonstrates how to verify an XML digital signature that contains multiple references. Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Http,
  Chilkat.StringBuilder,
  Chilkat.XmlDSig;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  http: THttp;
  sbXml: TStringBuilder;
  verifier: TXmlDSig;
  verifyReferenceDigests: Boolean;
  verified: Boolean;
  signedInfoVerified: Boolean;
  numRefs: Integer;
  i: Integer;
  refDigestVerified: Boolean;

begin
  success := False;

  //  This example requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  An example of an enveloping XML signature with mulitple references is available at
  //  https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml

  //  This example will show how to verify the signature and all references, and also how
  //  to verify each reference individually.  This is useful to distinguish which part
  //  of the XML signature validation failed.  It could be that one or more of the references
  //  failed because of a hash computation mismatch.  Or it could be that the signature over
  //  the SignedInfo failed.  

  //  First, let's grab the sample XML signature.
  http := THttp.Create;
  sbXml := TStringBuilder.Create;
  success := http.QuickGetSb('https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml',sbXml);
  if (success <> True) then
    begin
      WriteLn(http.LastErrorText);
      Exit;
    end;

  //  Load the XML containing the signature to be verified.
  verifier := TXmlDSig.Create;
  success := verifier.LoadSignatureSb(sbXml);
  if (success <> True) then
    begin
      WriteLn(verifier.LastErrorText);
      Exit;
    end;

  verifyReferenceDigests := True;

  //  The quick way to validate all references and the signature over the SignedInfo
  //  is to call VerifySignature with verifyReferenceDigests equal to True.
  verified := verifier.VerifySignature(verifyReferenceDigests);
  WriteLn('Signature and all reference digests verified = ' + verified);

  //  Let's pretend the call to VerifySignature returned False.  Something did not validate.
  //  Was it one or more of the References that did not hash to the correct value?
  //  Or was it the signature over the SignedInfo that failed?
  //  We can check just the signature over the SignedInfo by passing False to VerifySignature.
  //  This allows us to skip the hashing and checking each Reference.  
  verifyReferenceDigests := False;
  signedInfoVerified := verifier.VerifySignature(verifyReferenceDigests);
  WriteLn('Neglecting the reference hashes, the SignedInfo validation result = ' + signedInfoVerified);

  //  We can also verify each reference digest separately
  numRefs := verifier.NumReferences;
  i := 0;
  while i < numRefs do
    begin
      refDigestVerified := verifier.VerifyReferenceDigest(i);
      WriteLn('Reference ' + i + ' digest verified = ' + refDigestVerified);
      i := i + 1;
    end;

  //  For this sample XML signature with 3 References, we get the following output:

  //  Signature and all reference digests verified = True
  //  Neglecting the reference hashes, the SignedInfo validation result = True
  //  Reference 0 digest verified = True
  //  Reference 1 digest verified = True
  //  Reference 2 digest verified = True


  http.Free;
  sbXml.Free;
  verifier.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.