[英]XML Signature Validation
我有一个我无法解决的问题。 我的应用程序收到了(据说)签名的XML,我必须验证它是否正确。 这是XML接收内容的签名部分
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="35121103220612000188550010000000131000009300">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>uLZ/66r6OoNLpj5v4cIsrv5zmyc=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>encoded</SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate>encoded</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
我在互联网上找到的用于验证的所有内容都需要公钥。 但是我没有。 我只有DigestValue。 您知道是否可以仅使用DiggestValue进行验证?
到目前为止,这就是我所拥有的。 问题是从哪里获取X509KeySelector的密钥
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
DocumentBuilder builder = dbf.newDocumentBuilder();
Document doc = builder.parse("/home/test.xml");
Node nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature").item(0);
DOMValidateContext valContext = new DOMValidateContext(new X509KeySelector(publicKey), nl);
XMLSignatureFactory factory = XMLSignatureFactory.getInstance("DOM");
XMLSignature signature = factory.unmarshalXMLSignature(valContext);
System.out.println(signature.validate(valContext));
提前致谢。
您可能需要在DocumentBuilderFactory上调用setNamespaceAware(true),否则它将引发以下异常:
Document implementation must support DOM Level 2 and be namespace aware
证书本身包含公用密钥:
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
InputStream in = new ByteArrayInputStream(Base64.getDecoder().decode(certificateStringFromXml));
X509Certificate cert = (X509Certificate)certFactory.generateCertificate(in);
PublicKey pk = cert.getPublicKey();
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.