(Android™) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat Android™ Downloads Android™ Java Libraries Android C/C++ Libraries

// Important: Don't forget to include the call to System.loadLibrary
// as shown at the bottom of this code sample.
package com.test;

import android.app.Activity;
import com.chilkatsoft.*;

import android.widget.TextView;
import android.os.Bundle;

public class SimpleActivity extends Activity {

  private static final String TAG = "Chilkat";

  // Called when the activity is first created.
  @Override
  public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // The signed XML we wish to verify contains external references such as this:

    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
    //     </ds:Reference>
    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
    //     </ds:Reference>

    CkXmlDSig verifier = new CkXmlDSig();
    CkHttp http = new CkHttp();

    // First load the signed XML
    CkStringBuilder sbSignedXml = new CkStringBuilder();
    boolean success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8");
    if (success == false) {
        Log.i(TAG, "Failed to load signed XML.");
        return;
        }

    success = verifier.LoadSignatureSb(sbSignedXml);
    if (success == false) {
        Log.i(TAG, verifier.lastErrorText());
        return;
        }

    // Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
    CkStringBuilder sbRefUri = new CkStringBuilder();
    CkBinData bd = new CkBinData();
    int numRefs = verifier.get_NumReferences();
    int i = 0;
    while (i < numRefs) {
        if (verifier.IsReferenceExternal(i) == true) {
            sbRefUri.Clear();
            sbRefUri.Append(verifier.referenceUri(i));
            if (sbRefUri.StartsWith("https://",false) == true) {
                Log.i(TAG, "External URL Reference: " + sbRefUri.getAsString());

                // Download the data at the URL and provide to the verifier.
                success = http.DownloadBd(sbRefUri.getAsString(),bd);
                if (success == false) {
                    Log.i(TAG, http.lastErrorText());
                    return;
                    }

                success = verifier.SetRefDataBd(i,bd);
                if (success == false) {
                    Log.i(TAG, verifier.lastErrorText());
                    return;
                    }

                }

            }

        i = i + 1;
        }

    // Now that we have the external data, verify the signature..
    boolean bVerified = verifier.VerifySignature(true);
    if (bVerified == false) {
        Log.i(TAG, verifier.lastErrorText());
        }

    Log.i(TAG, "Signature verified = " + String.valueOf(bVerified));

  }

  static {
      System.loadLibrary("chilkat");

      // Note: If the incorrect library name is passed to System.loadLibrary,
      // then you will see the following error message at application startup:
      //"The application <your-application-name> has stopped unexpectedly. Please try again."
  }
}