Java XML Digital Signature API
Java Platform, Standard Edition 6 (Java SE 6) is the Java XML Digital Signature API. This API allows us to generate and validate XML signatures. XML signatures are a standard for digital signatures in the XML data format, and they allow us to authenticate and protect the integrity of data in XML and web service transactions.
What is a digital signature?
XML Digital Signatures are digital signatures designed for use in XML transactions.
It allows us to sign more than one piece of data -- in binary or XML -- and to use any underlying cryptographic signature algorithm.
XML Signature can be used to sign only portions of a XML message.
The use of XML Digital Signatures involves two parts:
(a) XML Digital Signatures creation
(b) XML Digital Signatures verification.
There are three types of digital signature.
Detached Signature
In this case, the digital signature is generated independently and it is not part of the XML document. It means you will have two XML files, one is your XML file to be signed and another is the XML signature. Let see the skeletal structure of the XML document.
< signature >
…
</ signature>
Enveloping signature
In this case XML document remains inside the Signature object. It means <Signature> tag becomes the root element of the signed XML document. The following is the outline of the enveloping digital signature.
< signature >
< document >
…
</ document >
</ signature>
Enveloped signature
In this case, signature is the child of the XML object which is signed. It means <Signature> is a child XML tag in the mail XML document. The following is the structure of the enveloped digital signature.
<document>
<signature>
…
</signature>
</document>
XML Digital Signature example
The XML tag <Signature> basically contains 3 children tags.
<Signature>
<SignedInfo></SignedInfo>
<SignatureValue></SignatureValue>
<KeyInfo></KeyInfo>
</Signature>
<Signature> is the root element of the XML digital signature concept and it is a protocol that must be followed as instructed by W3C. <SignedInfo> element is the information that you signed. <SignatureValue> contains the actual signature with Base64-encoded content and finally <KeyInfo> indicates the public key. The structure of <SignedInfo> is given below.
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
<SignatureMethod Algorithm=" http://www.w3.org/2001/04/xmldsig-more#rsa-sha256/>
<Reference URI="">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<DigestValue>xe/kONljHYOi5X1sw8AmgIjbHw/SX8zjAT98pJahhI=</DigestValue>
</Reference>
</SignedInfo>
CanonicalizationMethod element
The CanonicalizationMethod element defines as a URI the algorithm used to canonic Alize the SignedInfo element before it is signed or validated. Canonicalization is the process of converting XML content to a physical representation, called the canonical form, in order to eliminate subtle changes that can invalidate a signature over that data. Canonicalization is necessary due to the nature of XML and the way it is parsed by different processors and intermediaries, which can change the data in such a way that the signature is no longer valid but the signed data is still logically equivalent. Canonicalization eliminates these permissible syntactic variances by converting the XML to a canonical form before generating or validating the signature.
SignatureMethod element
The SignatureMethod element defines as a URI the digital signature algorithm used to generate the signature, in this case the RSA-SHA256 algorithm used.
One or more Reference elements identify the data that is signed. Each Reference element identifies the data by way of a URI. The example in XML contains a single Reference element, and the URI is the empty String, "", which indicates the root of the document -- in other words, the whole document. The Reference URIs could also point to external data or to references within the same document.
Transforms element
The optional Transforms element contains a list of one or more Transform elements, each of which describes a transformation algorithm used to transform the data before it is digested and signed, or validated. The enveloped transform is required for enveloped signatures so that the Signature element itself is removed before calculating the signature value. Otherwise, the signature would include itself in the data to be signed, which is not correct.
DigestMethod element
The DigestMethod element defines as a URI the algorithm used to digest the data, in this case, SHA256. The Digest Value element contains the actual base64-encoded digest value.
The structure of <SignatureValue> is given below.
<SignatureValue>7vdS9h04J/slnfUO1aoQ/RbvWE=</SignatureValue>
SignatureValue element
The SignatureValue element contains the base64-encoded signature value of the signature over the SignedInfo element.
The structure of <KeyInfo> is given below.
<KeyInfo>
<X509Data>
<X509SubjectName>CN=rsa0,OU=clc,O=<sender>,L=location,ST=Unknown,C=</X509SubjectName>
<X509IssuerSerial>
<X509IssuerName>CN=sign0, OU=clc, O=<sender>, L=location, ST=Unknown, C=</X509IssuerName>
<X509SerialNumber>1328092436</X509SerialNumber>
</X509IssuerSerial>
</X509Data>
</KeyInfo>
The optional KeyInfo element contains information about the key that is needed to validate the signature.
KeyInfo element
The KeyInfo element can contain various kinds of content, such as X.509 certificates and Pretty Good Privacy (PGP) key identifiers. As per our requirement we use X.509 certificates. KeyInfo contains an X509Data element that contains an X509SubjectName element identifying the subject Distinguished Name of the signer's.
