Digital Sign Xml Made Easy

9102014 signatory

when a sam'l document needs to prove the integrity of part of the content of that document it uses the XML standard way of signing the content which is known as an enveloped XML digital signature here is an example of the assertion portion of an SML response note that this is not the whole response just the assertion portion and we want to prove the integrity of this assertion so we will apply some algorithms to this block of characters we begin by applying the exclusive canonical algorithm this defines how to treat whitespace and divine characters and non utf-8 encoded characters among other things then we will hash that result in this example we will use the sha-1 algorithm this will produce this hexadecimal value which we will convert to base64 and then save for later use next we need to make some room to insert an enveloped signature and then add the blank signing information we can see that there are three elements shown in red that do not have values yet the first value that we will fill in is the digest value of the XML element this signature applies to where the digest value is the sha-1 hash we performed on the previous slide we see that this digest value is part of an envelope signature which means this signature block should be inserted into the code just as we did a few seconds ago and it means that it applies to all the characters within the immediately enveloped element but none of the characters above or below this element next we see that we should use the canonicalization method that we used on the previous slide and that we should use the sha-1 hash that we used on the previous slide therefore it's time to insert the value from the previous slide into the digest value element now we want to focus solely on the signature block because we need to prove the integrity of this block of characters according to this statement we will assign the signature element with an RSA encryption sha-1 hash so let's take the block of characters and hash them with sha-1 then encrypt the hash with the RSA private key and finally base64 encoded the result we take this value and insert it into the signature element note that the actual signature is a little longer than the value shown here okay we can now prove the integrity of the signature block and it contains the digest of the enveloped block therefore we can prove the integrity then invoke block the only things left to do are add the x.509 certificate that holds the RSA public key associated with the artists a private key used to create the signature again the actual x.509 certificate will be much bigger than the value represented here and add back the enveloped element and there you have it the xml enveloped digital signature