Sample code for 30+ languages & platforms
Tcl

XML-DSig Add Object Reference with Transforms Specified Explicitly

Demonstrates how to use the new AddObjectRef2 method to explicitly specify the XML Transforms fragment.

Chilkat Tcl Downloads

Download Chilkat for Tcl
Tcl 

load ./chilkat.dll

set success 0

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set success 1

# Build the following XML to be signed:

# <?xml version="1.0" encoding="utf-8"?>
# <InitUpload xmlns="http://e-dokumenty.mf.gov.pl">
#     <DocumentType>JPK</DocumentType>
#     <Version>01.02.01.20160617</Version>
#     <EncryptionKey algorithm="RSA" encoding="Base64" mode="ECB" padding="PKCS#1">xxxx</EncryptionKey>
#     <DocumentList>
#         <Document>
#             <FormCode schemaVersion="1-1" systemCode="JPK_VAT (3)">JPK_VAT</FormCode>
#             <FileName>JPK_VAT_3_v1-1_20181201.xml</FileName>
#             <ContentLength>8736</ContentLength>
#             <HashValue algorithm="SHA-256" encoding="Base64">JEDI1pItwh6dj/Xx1uts/x61qnjZ4DLHpkZMhmf1oKQ=</HashValue>
#             <FileSignatureList filesNumber="1">
#                 <Packaging>
#                     <SplitZip mode="zip" type="split"/>
#                 </Packaging>
#                 <Encryption>
#                     <AES block="16" mode="CBC" padding="PKCS#7" size="256">
#                         <IV bytes="16" encoding="Base64">z64oN9zXHt1+S3XACRSCYw==</IV>
#                     </AES>
#                 </Encryption>
#                 <FileSignature>
#                     <OrdinalNumber>1</OrdinalNumber>
#                     <FileName>JPK_VAT_3_v1-1_20181201-000.xml.zip.aes</FileName>
#                     <ContentLength>16</ContentLength>
#                     <HashValue algorithm="MD5" encoding="Base64">5MX0q1935fvMjLFV7E1yDw==</HashValue>
#                 </FileSignature>
#             </FileSignatureList>
#         </Document>
#     </DocumentList>
# </InitUpload>

# Use this online tool to generate code from sample XML: 
# Generate Code to Create XML

set xmlToSign [new_CkXml]

CkXml_put_Tag $xmlToSign "InitUpload"
CkXml_AddAttribute $xmlToSign "xmlns" "http://e-dokumenty.mf.gov.pl"
CkXml_UpdateChildContent $xmlToSign "DocumentType" "JPK"
CkXml_UpdateChildContent $xmlToSign "Version" "01.02.01.20160617"
CkXml_UpdateAttrAt $xmlToSign "EncryptionKey" 1 "algorithm" "RSA"
CkXml_UpdateAttrAt $xmlToSign "EncryptionKey" 1 "encoding" "Base64"
CkXml_UpdateAttrAt $xmlToSign "EncryptionKey" 1 "mode" "ECB"
CkXml_UpdateAttrAt $xmlToSign "EncryptionKey" 1 "padding" "PKCS#1"
CkXml_UpdateChildContent $xmlToSign "EncryptionKey" "xxxx"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FormCode" 1 "schemaVersion" "1-1"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FormCode" 1 "systemCode" "JPK_VAT (3)"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FormCode" "JPK_VAT"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FileName" "JPK_VAT_3_v1-1_20181201.xml"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|ContentLength" "8736"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|HashValue" 1 "algorithm" "SHA-256"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|HashValue" 1 "encoding" "Base64"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|HashValue" "JEDI1pItwh6dj/Xx1uts/x61qnjZ4DLHpkZMhmf1oKQ="
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList" 1 "filesNumber" "1"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Packaging|SplitZip" 1 "mode" "zip"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Packaging|SplitZip" 1 "type" "split"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES" 1 "block" "16"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES" 1 "mode" "CBC"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES" 1 "padding" "PKCS#7"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES" 1 "size" "256"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES|IV" 1 "bytes" "16"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES|IV" 1 "encoding" "Base64"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FileSignatureList|Encryption|AES|IV" "z64oN9zXHt1+S3XACRSCYw=="
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FileSignatureList|FileSignature|OrdinalNumber" "1"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FileSignatureList|FileSignature|FileName" "JPK_VAT_3_v1-1_20181201-000.xml.zip.aes"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FileSignatureList|FileSignature|ContentLength" "16"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|FileSignature|HashValue" 1 "algorithm" "MD5"
CkXml_UpdateAttrAt $xmlToSign "DocumentList|Document|FileSignatureList|FileSignature|HashValue" 1 "encoding" "Base64"
CkXml_UpdateChildContent $xmlToSign "DocumentList|Document|FileSignatureList|FileSignature|HashValue" "5MX0q1935fvMjLFV7E1yDw=="

set gen [new_CkXmlDSigGen]

CkXmlDSigGen_put_SigLocation $gen "InitUpload"
CkXmlDSigGen_put_SigLocationMod $gen 0
CkXmlDSigGen_put_SigId $gen "id-1234"
CkXmlDSigGen_put_SigNamespacePrefix $gen "ds"
CkXmlDSigGen_put_SigNamespaceUri $gen "http://www.w3.org/2000/09/xmldsig#"
CkXmlDSigGen_put_SignedInfoCanonAlg $gen "EXCL_C14N"
CkXmlDSigGen_put_SignedInfoDigestMethod $gen "sha256"

# Create an Object to be added to the Signature.

# <xades:QualifyingProperties Target="#id-1234" xmlns:xades="http://uri.etsi.org/01903/v1.3.2#">
#     <xades:SignedProperties Id="xades-id-1234">
#         <xades:SignedSignatureProperties>
#             <xades:SigningTime>TO BE GENERATED BY CHILKAT</xades:SigningTime>
#             <xades:SigningCertificate>
#                 <xades:Cert>
#                     <xades:CertDigest>
#                         <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
#                         <ds:DigestValue>TO BE GENERATED BY CHILKAT</ds:DigestValue>
#                     </xades:CertDigest>
#                     <xades:IssuerSerial>
#                         <ds:X509IssuerName>TO BE GENERATED BY CHILKAT</ds:X509IssuerName>
#                         <ds:X509SerialNumber>TO BE GENERATED BY CHILKAT</ds:X509SerialNumber>
#                     </xades:IssuerSerial>
#                 </xades:Cert>
#             </xades:SigningCertificate>
#         </xades:SignedSignatureProperties>
#         <xades:SignedDataObjectProperties>
#             <xades:DataObjectFormat ObjectReference="#r-id-1">
#                 <xades:MimeType>text/xml</xades:MimeType>
#             </xades:DataObjectFormat>
#         </xades:SignedDataObjectProperties>
#     </xades:SignedProperties>
# </xades:QualifyingProperties>

set object1 [new_CkXml]

CkXml_put_Tag $object1 "xades:QualifyingProperties"
CkXml_AddAttribute $object1 "xmlns:xades" "http://uri.etsi.org/01903/v1.3.2#"
CkXml_AddAttribute $object1 "Target" "#id-1234"
CkXml_UpdateAttrAt $object1 "xades:SignedProperties" 1 "Id" "xades-id-1234"
# Note: It may be that http://www.w3.org/2001/04/xmlenc#sha256 is needed in the following line instead of http://www.w3.org/2000/09/xmldsig#sha1
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime" "TO BE GENERATED BY CHILKAT"
CkXml_UpdateAttrAt $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestMethod" 1 "Algorithm" "http://www.w3.org/2000/09/xmldsig#sha1"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestValue" "TO BE GENERATED BY CHILKAT"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:IssuerSerialV2" "TO BE GENERATED BY CHILKAT"
CkXml_UpdateAttrAt $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat" 1 "ObjectReference" "#r-id-1"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:MimeType" "text/xml"

CkXmlDSigGen_AddObject $gen "" [CkXml_getXml $object1] "" ""

# -------- Reference 1 --------
# Build the following Transforms fragment:

# <ds:Transforms>
#     <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
#         <ds:XPath>not(ancestor-or-self::ds:Signature)</ds:XPath>
#     </ds:Transform>
#     <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
# </ds:Transforms>

set xml1 [new_CkXml]

CkXml_put_Tag $xml1 "ds:Transforms"
CkXml_UpdateAttrAt $xml1 "ds:Transform" 1 "Algorithm" "http://www.w3.org/TR/1999/REC-xpath-19991116"
CkXml_UpdateChildContent $xml1 "ds:Transform|ds:XPath" "not(ancestor-or-self::ds:Signature)"
CkXml_UpdateAttrAt $xml1 "ds:Transform[1]" 1 "Algorithm" "http://www.w3.org/2001/10/xml-exc-c14n#"

CkXmlDSigGen_AddSameDocRef2 $gen "" "sha256" $xml1 ""
CkXmlDSigGen_SetRefIdAttr $gen "" "r-id-1"

# -------- Reference 2 --------
# Build the following Transforms fragment:

# <ds:Transforms>
#     <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
# </ds:Transforms>

set xml2 [new_CkXml]

CkXml_put_Tag $xml2 "ds:Transforms"
CkXml_UpdateAttrAt $xml2 "ds:Transform" 1 "Algorithm" "http://www.w3.org/2001/10/xml-exc-c14n#"

CkXmlDSigGen_AddObjectRef2 $gen "xades-id-1234" "sha256" $xml2 "http://uri.etsi.org/01903#SignedProperties"

# Provide a certificate + private key. (PFX password is test123)
set cert [new_CkCert]

set success [CkCert_LoadPfxFile $cert "qa_data/pfx/cert_test123.pfx" "test123"]
if {$success != 1} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkXml $xmlToSign
    delete_CkXmlDSigGen $gen
    delete_CkXml $object1
    delete_CkXml $xml1
    delete_CkXml $xml2
    delete_CkCert $cert
    exit
}

CkXmlDSigGen_SetX509Cert $gen $cert 1

CkXmlDSigGen_put_KeyInfoType $gen "X509Data"
CkXmlDSigGen_put_X509Type $gen "Certificate"

# Load XML to be signed...
set sbXml [new_CkStringBuilder]

CkXml_GetXmlSb $xmlToSign $sbXml

CkXmlDSigGen_put_Behaviors $gen "IndentedSignature"

# Sign the XML...
set success [CkXmlDSigGen_CreateXmlDSigSb $gen $sbXml]
if {$success != 1} then {
    puts [CkXmlDSigGen_lastErrorText $gen]
    delete_CkXml $xmlToSign
    delete_CkXmlDSigGen $gen
    delete_CkXml $object1
    delete_CkXml $xml1
    delete_CkXml $xml2
    delete_CkCert $cert
    delete_CkStringBuilder $sbXml
    exit
}

# -----------------------------------------------

# Save the signed XML to a file.
set success [CkStringBuilder_WriteFile $sbXml "qa_output/signedXml.xml" "utf-8" 0]

puts [CkStringBuilder_getAsString $sbXml]

# ----------------------------------------
# Verify the signatures we just produced...
set verifier [new_CkXmlDSig]

set success [CkXmlDSig_LoadSignatureSb $verifier $sbXml]
if {$success != 1} then {
    puts [CkXmlDSig_lastErrorText $verifier]
    delete_CkXml $xmlToSign
    delete_CkXmlDSigGen $gen
    delete_CkXml $object1
    delete_CkXml $xml1
    delete_CkXml $xml2
    delete_CkCert $cert
    delete_CkStringBuilder $sbXml
    delete_CkXmlDSig $verifier
    exit
}

set numSigs [CkXmlDSig_get_NumSignatures $verifier]
set verifyIdx 0
while {$verifyIdx < $numSigs} {
    CkXmlDSig_put_Selector $verifier $verifyIdx
    set verified [CkXmlDSig_VerifySignature $verifier 1]
    if {$verified != 1} then {
        puts [CkXmlDSig_lastErrorText $verifier]
        delete_CkXml $xmlToSign
        delete_CkXmlDSigGen $gen
        delete_CkXml $object1
        delete_CkXml $xml1
        delete_CkXml $xml2
        delete_CkCert $cert
        delete_CkStringBuilder $sbXml
        delete_CkXmlDSig $verifier
        exit
    }

    set verifyIdx [expr $verifyIdx + 1]
}
puts "All signatures were successfully verified."

delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $object1
delete_CkXml $xml1
delete_CkXml $xml2
delete_CkCert $cert
delete_CkStringBuilder $sbXml
delete_CkXmlDSig $verifier