Abstract
There is an article shows demo code for making XMLSignature by using Java XML Digital Signature API, where it actually uses org.jcp.xml.dsig.internal.dom.XMLDSigRI to do DOM formation, and the first provider in the java.security lookup order that will support SHA1 digestion, SHA1withRSA signing to do algorithm jobs.
DEBUG the codeFirstly, just copy the code from the article,
// Create a DOM XMLSignatureFactory that will be used to // generate the enveloped signature. XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM"); // Create a Reference to the enveloped document (in this case, // you are signing the whole document, so a URI of "" signifies // that, and also specify the SHA1 digest algorithm and // the ENVELOPED Transform. Reference ref = fac.newReference ("", fac.newDigestMethod(DigestMethod.SHA1, null), Collections.singletonList (fac.newTransform (Transform.ENVELOPED, (TransformParameterSpec) null)), null, null); // Create the SignedInfo. SignedInfo si = fac.newSignedInfo (fac.newCanonicalizationMethod (CanonicalizationMethod.INCLUSIVE, (C14NMethodParameterSpec) null), fac.newSignatureMethod(SignatureMethod.RSA_SHA1, null), Collections.singletonList(ref)); // Load the KeyStore and get the signing key and certificate. KeyStore ks = KeyStore.getInstance("JKS"); ks.load(new FileInputStream("mykeystore.jks"), "changeit".toCharArray()); KeyStore.PrivateKeyEntry keyEntry = (KeyStore.PrivateKeyEntry) ks.getEntry ("mykey", new KeyStore.PasswordProtection("changeit".toCharArray())); X509Certificate cert = (X509Certificate) keyEntry.getCertificate(); // Create the KeyInfo containing the X509Data. KeyInfoFactory kif = fac.getKeyInfoFactory(); List x509Content = new ArrayList(); x509Content.add(cert.getSubjectX500Principal().getName()); x509Content.add(cert); X509Data xd = kif.newX509Data(x509Content); KeyInfo ki = kif.newKeyInfo(Collections.singletonList(xd)); // Instantiate the document to be signed. DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); Document doc = dbf.newDocumentBuilder().parse (new FileInputStream("purchaseOrder.xml")); // Create a DOMSignContext and specify the RSA PrivateKey and // location of the resulting XMLSignature"s parent element. DOMSignContext dsc = new DOMSignContext (keyEntry.getPrivateKey(), doc.getDocumentElement()); // Create the XMLSignature, but don"t sign it yet. XMLSignature signature = fac.newXMLSignature(si, ki); // Marshal, generate, and sign the enveloped signature. signature.sign(dsc); // Output the resulting document. OutputStream os = new FileOutputStream("signedPurchaseOrder.xml"); TransformerFactory tf = TransformerFactory.newInstance(); Transformer trans = tf.newTransformer(); trans.transform(new DOMSource(doc), new StreamResult(os));
follow the code comments, it is clearly several parts to making the job done, the key line is signature.sign(dsc);;
Secondly, debuging into the sign method, you will notice such as,
digestReference, digest invocations
that is for Message Digest
sign invocation
that is for Signature signing.
If you want to supply another provider to do the signing, you will have to implements the interface SignatureMethod, or extends the abstract class DOMSignatureMethod. However, the sign method in DOMSignatureMethod as you will override, is a little more complicated, even coupled with org.jcp.xml.dsig.internal.dom.SignatureProvider, and must take care of DOM structure yourself.
use apache xmlsecThe apache xmlsec has supply boilerplate code to do XMLSignature, but in a more clearly style,
public String signWithKeyPair(String sourceXml, KeyPair kp) throws Exception { PrivateKey privateKey = kp.getPrivate(); Document doc = null; try (InputStream is = new ByteArrayInputStream(sourceXml.getBytes(Charset.forName("utf-8")))) { doc = MyXMLUtils.read(is, false); } Element root = doc.getDocumentElement(); Element canonElem = XMLUtils.createElementInSignatureSpace(doc, Constants._TAG_CANONICALIZATIONMETHOD); canonElem.setAttributeNS( null, Constants._ATT_ALGORITHM, Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS ); SignatureAlgorithm signatureAlgorithm = new SignatureAlgorithm(doc, XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA1); XMLSignature sig = new XMLSignature(doc, null, signatureAlgorithm.getElement(), canonElem); root.appendChild(sig.getElement()); Transforms transforms = new Transforms(doc); transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE); sig.addDocument("", transforms, Constants.ALGO_ID_DIGEST_SHA1); sig.addKeyInfo(kp.getPublic()); sig.sign(privateKey); ByteArrayOutputStream bos = new ByteArrayOutputStream(); XMLUtils.outputDOMc14nWithComments(doc, bos); return new String(bos.toByteArray(), "utf-8"); }
If use xmlsec and want to supply your own Provider to make signature, it will be less effort to hook into the Architecture. and also making more sense when you extends SignatureAlgorithm class, supply your engine to override the following methods,
@Override public void update(byte[] input) throws XMLSignatureException { try { engine.update(input); } catch (SignatureException e) { throw new XMLSignatureException(e); } } @Override public void update(byte input) throws XMLSignatureException { try { engine.update(input); } catch (SignatureException e) { throw new XMLSignatureException(e); } } @Override public void update(byte[] buf, int offset, int len) throws XMLSignatureException { try { engine.update(buf, offset, len); } catch (SignatureException e) { throw new XMLSignatureException(e); } } @Override public void initSign(Key signingKey) throws XMLSignatureException { try { engine.initSign((PrivateKey) signingKey); } catch (InvalidKeyException e) { throw new RuntimeException(e); } } @Override public void initSign(Key signingKey, SecureRandom secureRandom) throws XMLSignatureException { try { engine.initSign((PrivateKey) signingKey, secureRandom); } catch (InvalidKeyException e) { throw new RuntimeException(e); } } @Override public void initSign(Key signingKey, AlgorithmParameterSpec algorithmParameterSpec) throws XMLSignatureException { throw new XMLSignatureException("unsupported operation"); } @Override public byte[] sign() throws XMLSignatureException { try { return engine.sign(); } catch (SignatureException e) { throw new XMLSignatureException(e); } } @Override public void initVerify(Key verificationKey) throws XMLSignatureException { try { engine.initVerify((PublicKey) verificationKey); } catch (InvalidKeyException e) { throw new XMLSignatureException(e); } } @Override public boolean verify(byte[] signature) throws XMLSignatureException { try { return engine.verify(signature); } catch (SignatureException e) { throw new XMLSignatureException(e); } }
not need to take care of the DOM structure any more.
use Bouncy Castle ProviderMaking this post more specific, I will show more codes about extends SignatureAlgorithm class along with using the engine from Bouncy Castle Provider.
public class BcSignatureAlgorithm extends AbstractSignatureAlgorithm { protected Signature engine; protected static BouncyCastleProvider provider = new BouncyCastleProvider(); public BcSignatureAlgorithm(Document doc, String algorithmURI) throws XMLSecurityException { super(doc, algorithmURI); initEngine(); } public BcSignatureAlgorithm(Document doc, String algorithmURI, int hmacOutputLength) throws XMLSecurityException { super(doc, algorithmURI, hmacOutputLength); initEngine(); } public BcSignatureAlgorithm(Element element, String baseURI) throws XMLSecurityException { super(element, baseURI); initEngine(); } public BcSignatureAlgorithm(Element element, String baseURI, boolean secureValidation) throws XMLSecurityException { super(element, baseURI, secureValidation); initEngine(); } protected void initEngine() throws XMLSecurityException { try { engine = Signature.getInstance("SHA1withRSA", provider); } catch (NoSuchAlgorithmException e) { throw new XMLSignatureException(e); } } }
nothing more, call the SPI getInstance method to get the engine object.
How to use the BcSignatureAlgorithm?
public String signWithCert(String sourceXml, PrivateKey privateKey, X509Certificate signingCert) throws Exception { Document doc = null; try (InputStream is = new ByteArrayInputStream(sourceXml.getBytes(Charset.forName("utf-8")))) { doc = MyXMLUtils.read(is, false); } Element root = doc.getDocumentElement(); Element canonElem = XMLUtils.createElementInSignatureSpace(doc, Constants._TAG_CANONICALIZATIONMETHOD); canonElem.setAttributeNS( null, Constants._ATT_ALGORITHM, Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS ); AbstractSignatureAlgorithm signatureAlgorithm = new BcSignatureAlgorithm(doc, XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA1);//use BcSignatureAlgorithm XMLSignature sig = new XMLSignature(doc, null, signatureAlgorithm.getElement(), canonElem); root.appendChild(sig.getElement()); Transforms transforms = new Transforms(doc); transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE); sig.addDocument("", transforms, Constants.ALGO_ID_DIGEST_SHA1); //sig.addKeyInfo(signingCert); X509Data x509data = new X509Data(doc); x509data.addCertificate(signingCert); sig.getKeyInfo().addKeyName(signingCert.getSerialNumber().toString()); sig.getKeyInfo().add(x509data); //sig.sign(privateKey); signatureAlgorithm.doSign(privateKey,sig.getSignedInfo()); ByteArrayOutputStream bos = new ByteArrayOutputStream(); XMLUtils.outputDOMc14nWithComments(doc, bos); return new String(bos.toByteArray(), "utf-8"); }
AbstractSignatureAlgorithm will finished the jobs that XMLSignature.sign(PrivateKey) used to do, actually doSign method copy lines from it, and make sure the signature value should set to SignatureValue Element as a text node element. Last but not least, thought BcSignatureAlgorithm is behind the sight, it has used the engine from the Bouncy Castle and produce the signature.
For More InformationProgramming With the Java XML Digital Signature API
xml-sec
文章版权归作者所有,未经允许请勿转载,若此文章存在违规行为,您可以联系管理员删除。
转载请注明本文地址:https://www.ucloud.cn/yun/77043.html
摘要:源码学习笔记该类是用来加密的引擎类,支持对称和非对称加密。函数创建对象操作其中方法是在中操作的方法,其他几个都使用执行。状态变化内部类内部类是用来解析中传入的字符串的。查询时,也会查询别名是否等于。知其然知其所以然。 javax.crypto.Cipher 源码学习笔记 该类是JCE用来加密的引擎类,支持对称和非对称加密。该类的介绍可以参考:[[译]JCA参考指南(二):核心类和接口]...
摘要:内部类提供本服务的服务的类型算法名称本服务的实现类的名称别名列表空如果服务没有别名属性映射空如果实现没有属性以的算法为例输出的结果其中查看支持的密钥类型继承类函数前三种是类的全路径名称带有后三种中的方法返回中所有的条目返回中所有的条目中 java.security.Provider 内部类Service /** * Construct a new service. * * @param...
摘要:本文为翻译和转载自以下是显示如何使用的最佳投票示例。这些示例是从开源项目中提取的。您可以对您喜欢的示例进行投票,您的投票将在我们的系统中使用,以生成更多好的示例。示例十九生成证书并存为格式和格式 本文为翻译和转载自 :https://www.programcreek.com/... 以下是显示如何使用 org.bouncycastle.openssl.PEMWriter 的最佳投票...
摘要:时间年月日星期三说明本文部分内容均来自慕课网。秘密密钥,生成一个分组的秘密密钥。 时间:2017年4月12日星期三说明:本文部分内容均来自慕课网。@慕课网:http://www.imooc.com教学示例源码:https://github.com/zccodere/s...个人学习源码:https://github.com/zccodere/s... 第一章:概述 1-1 概述 非对称...
时间:2017年4月10日星期一说明:本文部分内容均来自慕课网。@慕课网:http://www.imooc.com教学示例源码:https://github.com/zccodere/s...个人学习源码:https://github.com/zccodere/s... 第一章:概述 1-1 Java实现消息摘要算法加密 消息摘要算法 MD(Message Digest) SHA(Secure H...
阅读 4152·2023-04-26 02:40
阅读 2655·2023-04-26 02:31
阅读 2746·2021-11-15 18:08
阅读 568·2021-11-12 10:36
阅读 1425·2021-09-30 09:57
阅读 5192·2021-09-22 15:31
阅读 2626·2019-08-30 14:17
阅读 1269·2019-08-30 12:58