Replies: 1 comment 2 replies
-
|
Could you please provide more information about your question? A version number of xml-crypto would be quite helpful. Also, it would be helpful to see what you've tried and where you've run into issues. Perhaps even some sample code. |
Beta Was this translation helpful? Give feedback.
-
|
HI, I think I have the same problem. Version: 6.0.0 sig.addReference({ sig.canonicalizationAlgorithm = 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315'; When sending the xml generated on an exempt platform I get the following error: Invalid content was found starting with element 'X509Data'. One of '{"http://www.w3.org/2000/09/xmldsig#":KeyValue}' is expected.
Why does it require that you include the keyvalue before x509Data, which is not generated anywhere using the library? |
Beta Was this translation helpful? Give feedback.
-
|
@calazcano if you had code snippet which reproduces your problem it would have been super nice if you would have posted it instead of subset of it. Here is guestimate of your code (btw. this guestimate of your code doesn't seem to reproduce your problem but maybe you can modify it so that your problem is reproduced): /*
related to
https://github.com/node-saml/xml-crypto/discussions/400#discussioncomment-8713219
packagejson
{
"name": "foo",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"dependencies": {
"xml-crypto": "6.0.0"
}
}
*/
// reverse engineered / guessed that maybe author
// of discussion comment had something like this
const SignedXml = require("xml-crypto").SignedXml
const config = {
sii: {
// https://raw.githubusercontent.com/node-saml/xml-crypto/v6.0.0/test/static/client.pem
key: `
-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAL4vpoH3H3byehjj
7RAGxefGRATiq4mXtzc9Q91W7uT0DTaFEbjzVch9aGsNjmLs4QHsoZbuoUmi0st4
x5z9SQpTAKC/dW8muzacT3E7dJJYh03MAO6RiH4LG34VRTq1SQN6qDt2rCK85eG4
5NHI4jceptZNu6Zot1zyO5/PYuFpAgMBAAECgYAhspeyF3M/xB7WIixy1oBiXMLY
isESFAumgfhwU2LotkVRD6rgNl1QtMe3kCNWa9pCWQcYkxeI0IzA+JmFu2shVvoR
oL7eV4VCe1Af33z24E46+cY5grxNhHt/LyCnZKcitvCcrzXExUc5n6KngX0mMKgk
W7skZDwsnKzhyUV8wQJBAN2bQMeASQVOqdfqBdFgC/NPnKY2cuDi6h659QN1l+kg
X3ywdZ7KKftJo1G9l45SN9YpkyEd9zEO6PMFaufJvZUCQQDbtAWxk0i8BT3UTNWC
T/9bUQROPcGZagwwnRFByX7gpmfkf1ImIvbWVXSpX68/IjbjSkTw1nj/Yj1NwFZ0
nxeFAkEAzPhRpXVBlPgaXkvlz7AfvY+wW4hXHyyi0YK8XdPBi25XA5SPZiylQfjt
Z6iN6qSfYqYXoPT/c0/QJR+orvVJNQJBANhRPNXljVTK2GDCseoXd/ZiI5ohxg+W
UaA/1fDvQsRQM7TQA4NXI7BO/YmSk4rW1jIeOxjiIspY4MFAIh+7UL0CQFL6zTg6
wfeMlEZzvgqwCGoLuvTnqtvyg45z7pfcrg2cHdgCXIy9kErcjwGiu6BOevEA1qTW
Rk+bv0tknWvcz/s=
-----END PRIVATE KEY-----
`,
// https://raw.githubusercontent.com/node-saml/xml-crypto/v6.0.0/test/static/client_public.pem
cert: `
-----BEGIN CERTIFICATE-----
MIIBxDCCAW6gAwIBAgIQxUSXFzWJYYtOZnmmuOMKkjANBgkqhkiG9w0BAQQFADAW
MRQwEgYDVQQDEwtSb290IEFnZW5jeTAeFw0wMzA3MDgxODQ3NTlaFw0zOTEyMzEy
MzU5NTlaMB8xHTAbBgNVBAMTFFdTRTJRdWlja1N0YXJ0Q2xpZW50MIGfMA0GCSqG
SIb3DQEBAQUAA4GNADCBiQKBgQC+L6aB9x928noY4+0QBsXnxkQE4quJl7c3PUPd
Vu7k9A02hRG481XIfWhrDY5i7OEB7KGW7qFJotLLeMec/UkKUwCgv3VvJrs2nE9x
O3SSWIdNzADukYh+Cxt+FUU6tUkDeqg7dqwivOXhuOTRyOI3HqbWTbumaLdc8juf
z2LhaQIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEU
MBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwDQYJKoZIhvcN
AQEEBQADQQAfIbnMPVYkNNfX1tG1F+qfLhHwJdfDUZuPyRPucWF5qkh6sSdWVBY5
sT/txBnVJGziyO8DPYdu2fPMER8ajJfl
-----END CERTIFICATE-----
`
}
}
var xml = '<Documento />'
// ---------------------------------------------------
// START code snippet from discussion comment
// https://github.com/node-saml/xml-crypto/discussions/400#discussioncomment-8713219
let sig = new SignedXml({ privateKey: config.sii.key, publicCert: config.sii.cert });
sig.addReference({
xpath: "//*[local-name(.)='Documento']",
digestAlgorithm: 'http://www.w3.org/2000/09/xmldsig#sha1',
transforms: [
// added enveloped signature transformation in order to
// have result which signature is successfully validated
// by e.g. https://tools.chilkat.io/xmlDsigVerify.cshtml
// NOTE: discussion
// https://github.com/node-saml/xml-crypto/discussions/400#discussioncomment-8713219
// is about content of KeyInfo element i.e. this transformation
// should not affect debugging of that discussion item's
// case
'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
'http://www.w3.org/TR/2001/REC-xml-c14n-20010315'
],
});
sig.canonicalizationAlgorithm = 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315';
sig.signatureAlgorithm = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1';
// END code snippet from discussion comment
// ---------------------------------------------------
sig.computeSignature(xml)
console.log(sig.getSignedXml())output of the script is <Documento Id="_0"><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_0"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>yK02Eaj6S3BND8oN7exmQC5XndY=</DigestValue></Reference></SignedInfo><SignatureValue>bnTdWX+aSroh8+/W9hHlTvV2/J83RcxLbxHtwXyjzQqlJCqE7VoHaAC7LwC6q1xLbxczVG/drns8/DvbYVBKZVVsGwUhFJh2kcDNdx4ebvs4btSleEtPGgREIxepVvrg2CjDiDSrxsL0/13gjqYkDUeOX98Gf3Xu3R3o0oonptg=</SignatureValue><KeyInfo><X509Data><X509Certificate>MIIBxDCCAW6gAwIBAgIQxUSXFzWJYYtOZnmmuOMKkjANBgkqhkiG9w0BAQQFADAWMRQwEgYDVQQDEwtSb290IEFnZW5jeTAeFw0wMzA3MDgxODQ3NTlaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBgNVBAMTFFdTRTJRdWlja1N0YXJ0Q2xpZW50MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+L6aB9x928noY4+0QBsXnxkQE4quJl7c3PUPdVu7k9A02hRG481XIfWhrDY5i7OEB7KGW7qFJotLLeMec/UkKUwCgv3VvJrs2nE9xO3SSWIdNzADukYh+Cxt+FUU6tUkDeqg7dqwivOXhuOTRyOI3HqbWTbumaLdc8jufz2LhaQIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwDQYJKoZIhvcNAQEEBQADQQAfIbnMPVYkNNfX1tG1F+qfLhHwJdfDUZuPyRPucWF5qkh6sSdWVBY5sT/txBnVJGziyO8DPYdu2fPMER8ajJfl</X509Certificate></X509Data></KeyInfo></Signature></Documento>if aforementioed output is pasted to https://tools.chilkat.io/xmlDsigVerify.cshtml it doesn't mention any xml schema related issues. for the sake of readability here is pretty printed output ( <Documento Id="_0">
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#_0">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>yK02Eaj6S3BND8oN7exmQC5XndY=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>bnTdWX+aSroh8+/W9hHlTvV2/J83RcxLbxHtwXyjzQqlJCqE7VoHaAC7LwC6q1xLbxczVG/drns8/DvbYVBKZVVsGwUhFJh2kcDNdx4ebvs4btSleEtPGgREIxepVvrg2CjDiDSrxsL0/13gjqYkDUeOX98Gf3Xu3R3o0oonptg=</SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate>MIIBxDCCAW6gAwIBAgIQxUSXFzWJYYtOZnmmuOMKkjANBgkqhkiG9w0BAQQFADAWMRQwEgYDVQQDEwtSb290IEFnZW5jeTAeFw0wMzA3MDgxODQ3NTlaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBgNVBAMTFFdTRTJRdWlja1N0YXJ0Q2xpZW50MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+L6aB9x928noY4+0QBsXnxkQE4quJl7c3PUPdVu7k9A02hRG481XIfWhrDY5i7OEB7KGW7qFJotLLeMec/UkKUwCgv3VvJrs2nE9xO3SSWIdNzADukYh+Cxt+FUU6tUkDeqg7dqwivOXhuOTRyOI3HqbWTbumaLdc8jufz2LhaQIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwDQYJKoZIhvcNAQEEBQADQQAfIbnMPVYkNNfX1tG1F+qfLhHwJdfDUZuPyRPucWF5qkh6sSdWVBY5sT/txBnVJGziyO8DPYdu2fPMER8ajJfl</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
</Documento>Content of the ...
<element name="KeyInfo" type="ds:KeyInfoType"/>
<complexType name="KeyInfoType" mixed="true">
<choice maxOccurs="unbounded">
<element ref="ds:KeyName"/>
<element ref="ds:KeyValue"/>
<element ref="ds:RetrievalMethod"/>
<element ref="ds:X509Data"/>
<element ref="ds:PGPData"/>
<element ref="ds:SPKIData"/>
<element ref="ds:MgmtData"/>
<any processContents="lax" namespace="##other"/>
<!-- (1,1) elements from (0,unbounded) namespaces -->
</choice>
<attribute name="Id" type="ID" use="optional"/>
</complexType>
...proof...lets take # fetch XM signature schema to tmp
curl \
https://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd \
> /tmp/xml-sig-schema.xsd
# validate content of signature element against schema
cat <<EOF | xmllint --schema /tmp/xml-sig-schema.xsd -
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#_0">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>yK02Eaj6S3BND8oN7exmQC5XndY=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>bnTdWX+aSroh8+/W9hHlTvV2/J83RcxLbxHtwXyjzQqlJCqE7VoHaAC7LwC6q1xLbxczVG/drns8/DvbYVBKZVVsGwUhFJh2kcDNdx4ebvs4btSleEtPGgREIxepVvrg2CjDiDSrxsL0/13gjqYkDUeOX98Gf3Xu3R3o0oonptg=</SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate>MIIBxDCCAW6gAwIBAgIQxUSXFzWJYYtOZnmmuOMKkjANBgkqhkiG9w0BAQQFADAWMRQwEgYDVQQDEwtSb290IEFnZW5jeTAeFw0wMzA3MDgxODQ3NTlaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBgNVBAMTFFdTRTJRdWlja1N0YXJ0Q2xpZW50MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+L6aB9x928noY4+0QBsXnxkQE4quJl7c3PUPdVu7k9A02hRG481XIfWhrDY5i7OEB7KGW7qFJotLLeMec/UkKUwCgv3VvJrs2nE9xO3SSWIdNzADukYh+Cxt+FUU6tUkDeqg7dqwivOXhuOTRyOI3HqbWTbumaLdc8jufz2LhaQIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwDQYJKoZIhvcNAQEEBQADQQAfIbnMPVYkNNfX1tG1F+qfLhHwJdfDUZuPyRPucWF5qkh6sSdWVBY5sT/txBnVJGziyO8DPYdu2fPMER8ajJfl</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
EOF
# output seems to be "validates"So...could you take aforementioned guestimate of your implementation and modify it so that it resembles better how you use xml-crypto (and maybe shows situation where xml-crypto produces KeyInfo with content that does not respect xml sig XMLSchema definition). |
Beta Was this translation helpful? Give feedback.
-
Discussed in #362
Originally posted by brugambwa July 26, 2023
EDIT: The first reference and the digest is calculated on the KeyInfo tag, which is added using the getKeyInfoContent. So the addReference cannot find the reference to the KeyInfo tag as it's not part of the initial XML. Is there an implementation I could use/change in the library to be able to produce the output below?
Beta Was this translation helpful? Give feedback.
All reactions