Tcl
Tcl
XML-DSig Add Reference with Transforms Specified Explicitly
Demonstrates how to use the new AddSameDocRef2 method to explicitly specify the XML Transforms fragment.Chilkat Tcl Downloads
load ./chilkat.dll
set success 0
# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.
set success 1
# Create the following XML to be signed:
# <doc>
# <s id="s1">Some text...</s>
# <p>Some text...</p>
# <p class="note">A note...</p>
# </doc>
# Use this online tool to generate code from sample XML:
# Generate Code to Create XML
set xmlToSign [new_CkXml]
CkXml_put_Tag $xmlToSign "doc"
CkXml_UpdateAttrAt $xmlToSign "s" 1 "id" "s1"
CkXml_UpdateChildContent $xmlToSign "s" "Some text..."
CkXml_UpdateChildContent $xmlToSign "p" "Some text..."
CkXml_UpdateAttrAt $xmlToSign "p[1]" 1 "class" "note"
CkXml_UpdateChildContent $xmlToSign "p[1]" "A note..."
puts [CkXml_getXml $xmlToSign]
set gen [new_CkXmlDSigGen]
CkXmlDSigGen_put_SigLocation $gen "doc"
CkXmlDSigGen_put_SigLocationMod $gen 0
CkXmlDSigGen_put_SigId $gen "Signature-78f29839-06af-448f-b479-ca46457fab1b-Signature"
CkXmlDSigGen_put_SigNamespacePrefix $gen "ds"
CkXmlDSigGen_put_SigNamespaceUri $gen "http://www.w3.org/2000/09/xmldsig#"
CkXmlDSigGen_put_SigValueId $gen "Signature-78f29839-06af-448f-b479-ca46457fab1b-SignatureValue"
CkXmlDSigGen_put_SignedInfoCanonAlg $gen "C14N"
CkXmlDSigGen_put_SignedInfoDigestMethod $gen "sha1"
# Set the KeyInfoId before adding references..
CkXmlDSigGen_put_KeyInfoId $gen "Signature-78f29839-06af-448f-b479-ca46457fab1b-KeyInfo"
# The following XML to be added as an Object to the Signature
# Use this online tool to generate code from sample XML:
# Generate Code to Create XML
# <xades:QualifyingProperties Id="Signature-78f29839-06af-448f-b479-ca46457fab1b-QualifyingProperties" Target="#Signature-78f29839-06af-448f-b479-ca46457fab1b-Signature" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xades="http://uri.etsi.org/01903/v1.3.2#">
# <xades:SignedProperties Id="Signature-78f29839-06af-448f-b479-ca46457fab1b-SignedProperties">
# <xades:SignedSignatureProperties>
# <xades:SigningTime>TO BE GENERATED BY CHILKAT</xades:SigningTime>
# <xades:SigningCertificate>
# <xades:Cert>
# <xades:CertDigest>
# <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
# <ds:DigestValue>TO BE GENERATED BY CHILKAT</ds:DigestValue>
# </xades:CertDigest>
# <xades:IssuerSerial>
# <ds:X509IssuerName>TO BE GENERATED BY CHILKAT</ds:X509IssuerName>
# <ds:X509SerialNumber>TO BE GENERATED BY CHILKAT</ds:X509SerialNumber>
# </xades:IssuerSerial>
# </xades:Cert>
# </xades:SigningCertificate>
# </xades:SignedSignatureProperties>
# <xades:SignedDataObjectProperties>
# <xades:DataObjectFormat ObjectReference="#Reference-24eb6003-d41c-442c-a731-d4c58f94790b">
# <xades:Description/>
# <xades:ObjectIdentifier>
# <xades:Identifier Qualifier="OIDAsURN">urn:oid:1.2.840.10003.5.109.10</xades:Identifier>
# <xades:Description/>
# </xades:ObjectIdentifier>
# <xades:MimeType>text/xml</xades:MimeType>
# <xades:Encoding/>
# </xades:DataObjectFormat>
# </xades:SignedDataObjectProperties>
# </xades:SignedProperties>
# </xades:QualifyingProperties>
set object1 [new_CkXml]
CkXml_put_Tag $object1 "xades:QualifyingProperties"
CkXml_AddAttribute $object1 "Id" "Signature-78f29839-06af-448f-b479-ca46457fab1b-QualifyingProperties"
CkXml_AddAttribute $object1 "Target" "#Signature-78f29839-06af-448f-b479-ca46457fab1b-Signature"
CkXml_AddAttribute $object1 "xmlns:ds" "http://www.w3.org/2000/09/xmldsig#"
CkXml_AddAttribute $object1 "xmlns:xades" "http://uri.etsi.org/01903/v1.3.2#"
CkXml_UpdateAttrAt $object1 "xades:SignedProperties" 1 "Id" "Signature-78f29839-06af-448f-b479-ca46457fab1b-SignedProperties"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime" "TO BE GENERATED BY CHILKAT"
# Note: It may be that http://www.w3.org/2001/04/xmlenc#sha256 is needed in the following line instead of http://www.w3.org/2000/09/xmldsig#sha1
CkXml_UpdateAttrAt $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestMethod" 1 "Algorithm" "http://www.w3.org/2000/09/xmldsig#sha1"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestValue" "TO BE GENERATED BY CHILKAT"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:IssuerSerialV2" "TO BE GENERATED BY CHILKAT"
CkXml_UpdateAttrAt $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat" 1 "ObjectReference" "#Reference-24eb6003-d41c-442c-a731-d4c58f94790b"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:Description" ""
CkXml_UpdateAttrAt $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Identifier" 1 "Qualifier" "OIDAsURN"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Identifier" "urn:oid:1.2.840.10003.5.109.10"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Description" ""
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:MimeType" "text/xml"
CkXml_UpdateChildContent $object1 "xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:Encoding" ""
puts [CkXml_getXml $object1]
CkXmlDSigGen_AddObject $gen "" [CkXml_getXml $object1] "" ""
# -------- Reference 1 --------
# Create the following Transforms fragment:
# Use this online tool to generate code from sample XML:
# Generate Code to Create XML
# <ds:Transforms>
# <ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
# <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
# <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
# <ds:XPath xmlns:ds="http://www.w3.org/2000/09/xmldsig#">not(ancestor-or-self::ds:Signature)</ds:XPath>
# </ds:Transform>
# </ds:Transforms>
set xml1 [new_CkXml]
CkXml_put_Tag $xml1 "ds:Transforms"
CkXml_UpdateAttrAt $xml1 "ds:Transform" 1 "Algorithm" "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
CkXml_UpdateAttrAt $xml1 "ds:Transform[1]" 1 "Algorithm" "http://www.w3.org/2000/09/xmldsig#enveloped-signature"
CkXml_UpdateAttrAt $xml1 "ds:Transform[2]" 1 "Algorithm" "http://www.w3.org/TR/1999/REC-xpath-19991116"
CkXml_UpdateAttrAt $xml1 "ds:Transform[2]|ds:XPath" 1 "xmlns:ds" "http://www.w3.org/2000/09/xmldsig#"
CkXml_UpdateChildContent $xml1 "ds:Transform[2]|ds:XPath" "not(ancestor-or-self::ds:Signature)"
# This is the "Transforms" XML fragment passed to AddSameDocRef2.
puts [CkXml_getXml $xml1]
CkXmlDSigGen_AddSameDocRef2 $gen "" "sha1" $xml1 ""
CkXmlDSigGen_SetRefIdAttr $gen "" "Reference-24eb6003-d41c-442c-a731-d4c58f94790b"
# -------- Reference 2 --------
CkXmlDSigGen_AddObjectRef $gen "Signature-78f29839-06af-448f-b479-ca46457fab1b-SignedProperties" "sha1" "" "" "http://uri.etsi.org/01903#SignedProperties"
# -------- Reference 3 --------
CkXmlDSigGen_AddSameDocRef $gen "Signature-78f29839-06af-448f-b479-ca46457fab1b-KeyInfo" "sha1" "" "" ""
# Provide a certificate + private key. (PFX password is test123)
set cert [new_CkCert]
set success [CkCert_LoadPfxFile $cert "qa_data/pfx/cert_test123.pfx" "test123"]
if {$success != 1} then {
puts [CkCert_lastErrorText $cert]
delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $object1
delete_CkXml $xml1
delete_CkCert $cert
exit
}
CkXmlDSigGen_SetX509Cert $gen $cert 1
CkXmlDSigGen_put_KeyInfoType $gen "X509Data+KeyValue"
CkXmlDSigGen_put_X509Type $gen "CertChain"
# Load XML to be signed...
set sbXml [new_CkStringBuilder]
CkXml_GetXmlSb $xmlToSign $sbXml
CkXmlDSigGen_put_Behaviors $gen "IndentedSignature"
# Sign the XML...
set success [CkXmlDSigGen_CreateXmlDSigSb $gen $sbXml]
if {$success != 1} then {
puts [CkXmlDSigGen_lastErrorText $gen]
delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $object1
delete_CkXml $xml1
delete_CkCert $cert
delete_CkStringBuilder $sbXml
exit
}
# -----------------------------------------------
# Save the signed XML to a file.
set success [CkStringBuilder_WriteFile $sbXml "qa_output/signedXml.xml" "utf-8" 0]
puts [CkStringBuilder_getAsString $sbXml]
# ----------------------------------------
# Verify the signatures we just produced...
set verifier [new_CkXmlDSig]
set success [CkXmlDSig_LoadSignatureSb $verifier $sbXml]
if {$success != 1} then {
puts [CkXmlDSig_lastErrorText $verifier]
delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $object1
delete_CkXml $xml1
delete_CkCert $cert
delete_CkStringBuilder $sbXml
delete_CkXmlDSig $verifier
exit
}
set numSigs [CkXmlDSig_get_NumSignatures $verifier]
set verifyIdx 0
while {$verifyIdx < $numSigs} {
CkXmlDSig_put_Selector $verifier $verifyIdx
set verified [CkXmlDSig_VerifySignature $verifier 1]
if {$verified != 1} then {
puts [CkXmlDSig_lastErrorText $verifier]
delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $object1
delete_CkXml $xml1
delete_CkCert $cert
delete_CkStringBuilder $sbXml
delete_CkXmlDSig $verifier
exit
}
set verifyIdx [expr $verifyIdx + 1]
}
puts "All signatures were successfully verified."
delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $object1
delete_CkXml $xml1
delete_CkCert $cert
delete_CkStringBuilder $sbXml
delete_CkXmlDSig $verifier