SQL Server

Verify an XML Signature with Multiple References

See more XML Digital Signatures Examples

Demonstrates how to verify an XML digital signature that contains multiple references. SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    -- An example of an enveloping XML signature with mulitple references is available at
    -- https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml

    -- This example will show how to verify the signature and all references, and also how
    -- to verify each reference individually.  This is useful to distinguish which part
    -- of the XML signature validation failed.  It could be that one or more of the references
    -- failed because of a hash computation mismatch.  Or it could be that the signature over
    -- the SignedInfo failed.  

    -- First, let's grab the sample XML signature.
    DECLARE @http int
    EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @sbXml int
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbXml OUT

    EXEC sp_OAMethod @http, 'QuickGetSb', @success OUT, 'https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml', @sbXml
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbXml
        RETURN
      END

    -- Load the XML containing the signature to be verified.
    DECLARE @verifier int
    EXEC @hr = sp_OACreate 'Chilkat.XmlDSig', @verifier OUT

    EXEC sp_OAMethod @verifier, 'LoadSignatureSb', @success OUT, @sbXml
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @verifier, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbXml
        EXEC @hr = sp_OADestroy @verifier
        RETURN
      END

    DECLARE @verifyReferenceDigests int
    SELECT @verifyReferenceDigests = 1

    -- The quick way to validate all references and the signature over the SignedInfo
    -- is to call VerifySignature with verifyReferenceDigests equal to 1.
    DECLARE @verified int
    EXEC sp_OAMethod @verifier, 'VerifySignature', @verified OUT, @verifyReferenceDigests

    PRINT 'Signature and all reference digests verified = ' + @verified

    -- Let's pretend the call to VerifySignature returned 0.  Something did not validate.
    -- Was it one or more of the References that did not hash to the correct value?
    -- Or was it the signature over the SignedInfo that failed?
    -- We can check just the signature over the SignedInfo by passing 0 to VerifySignature.
    -- This allows us to skip the hashing and checking each Reference.  
    SELECT @verifyReferenceDigests = 0
    DECLARE @signedInfoVerified int
    EXEC sp_OAMethod @verifier, 'VerifySignature', @signedInfoVerified OUT, @verifyReferenceDigests

    PRINT 'Neglecting the reference hashes, the SignedInfo validation result = ' + @signedInfoVerified

    -- We can also verify each reference digest separately
    DECLARE @numRefs int
    EXEC sp_OAGetProperty @verifier, 'NumReferences', @numRefs OUT
    DECLARE @i int
    SELECT @i = 0
    WHILE @i < @numRefs
      BEGIN
        DECLARE @refDigestVerified int
        EXEC sp_OAMethod @verifier, 'VerifyReferenceDigest', @refDigestVerified OUT, @i


        PRINT 'Reference ' + @i + ' digest verified = ' + @refDigestVerified
        SELECT @i = @i + 1
      END

    -- For this sample XML signature with 3 References, we get the following output:

    -- Signature and all reference digests verified = True
    -- Neglecting the reference hashes, the SignedInfo validation result = True
    -- Reference 0 digest verified = True
    -- Reference 1 digest verified = True
    -- Reference 2 digest verified = Tru

    EXEC @hr = sp_OADestroy @http
    EXEC @hr = sp_OADestroy @sbXml
    EXEC @hr = sp_OADestroy @verifier


END
GO