DataFlex

Verify XML Signature with External Data Reference

See more XML Digital Signatures Examples

Demonstrates how to verify an XML digital signature where the data is external. In this case, the data is a JPG file.

This example requires Chilkat v9.5.0.69 or greater.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    String sUrl
    Handle hoHttp
    Variant vSbXml
    Handle hoSbXml
    Handle hoVerifier
    String sRefUri
    Variant vJpgData
    Handle hoJpgData
    Boolean iBVerified
    String sTemp1
    Boolean bTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // The XML containing the Signature to be verified contains the following:
    // <?xml version="1.0" encoding="UTF-8" standalone="no"?>
    // <abc>
    //   <xyz>
    //     <jpg>
    //         <name>starfish.jpg</name>
    //         <url>https://www.chilkatsoft.com/images/starfish.jpg</url>
    //     <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="https://www.chilkatsoft.com/images/starfish.jpg"><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>MbHOti6nOh9DJP/u7u1+a1u0wRYIGEdaAVk5ehxqeBhcR4qvGvCQ7wLxcfDuwFG2grSg43ANxDYngLqZTeFb5nCfywcuNBQI8FrNRVY5hkyv6kDW1BVN8ot9qPYX9oHxJp1e+nMszIiSxqHX3XDI7YnvFt/0CyeO5JaQQEzXzIwqqb8iUNcH/bJzR6CrTf1hGuQ5MPorG0bRwbYPPHHzipUqHBinK8VbHobnxL7GQHAhR8k9gDD35kZcMxf/74U7pGO19ZzTbdJW5S7q4bVVxvsuU3itTbhHI60pOE14ibrjZtIrPZLVUD3TQqIIF04TChW2NXdYOo3+ij4ZnP8x+g==</ds:SignatureValue><ds:KeyInfo><ds:KeyValue><ds:RSAKeyValue><ds:Modulus>sXeRhM55P13FbpNcXAMR3olbw2Wa6keZIHu5YTZYUBTlYWId+pNiwUz3zFIEo+0IfYR0H27ybIycQO+1IIzJofUFNMAL3tZps2OKPlsjuCPls6kXpXhv/gvhux8LrCtp4PcKWqJ6QVOZKChc7WAx40qFWzHi57ueqRTv3x0kESqGg/VjsqyTEvb55psJO2RsfhLT7+YVh3hImRM3RDaJdkTkPuOxeFyT6N7VXD09329sLuS3QkUbE9zEKDnz9X3d8dEQdJhSI9ba5fxl8R7fu8pB67ElfzFml96X1jLFtzy1pzOT5Fc4ROcaqlYckVzdBq9sxezm6MYmDBjNAcibRw==</ds:Modulus><ds:Exponent>AQAB</ds:Exponent></ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo></ds:Signature></jpg>
    //   </xyz>
    // </abc>

    // The above XML is available at https://www.chilkatsoft.com/exampleData/xmlsig_external_jpg_reference.xml
    // First fetch the XML..

    Move "https://www.chilkatsoft.com/exampleData/xmlsig_external_jpg_reference.xml" To sUrl
    Get Create (RefClass(cComChilkatHttp)) To hoHttp
    If (Not(IsComObjectCreated(hoHttp))) Begin
        Send CreateComObject of hoHttp
    End
    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbXml
    If (Not(IsComObjectCreated(hoSbXml))) Begin
        Send CreateComObject of hoSbXml
    End
    Get pvComObject of hoSbXml to vSbXml
    Get ComQuickGetSb Of hoHttp sUrl vSbXml To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoHttp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatXmlDSig)) To hoVerifier
    If (Not(IsComObjectCreated(hoVerifier))) Begin
        Send CreateComObject of hoVerifier
    End

    // Load the XML containing the signatures to be verified.
    // Note that this particular Signature already contains the RSA public key that will be used
    // for verification.
    Get pvComObject of hoSbXml to vSbXml
    Get ComLoadSignatureSb Of hoVerifier vSbXml To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoVerifier To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Get the Reference URI, which in this case is the URL to the binary data that was hashed.
    // This fetchs the URI attribute value from:  <ds:Reference URI="https://www.chilkatsoft.com/images/starfish.jpg">
    Get ComReferenceUri Of hoVerifier 0 To sRefUri
    Get ComLastMethodSuccess Of hoVerifier To bTemp1
    If (bTemp1 <> True) Begin
        Showln "No reference URI found."
        Procedure_Return
    End

    // Download the JPG data to be verified.
    Get Create (RefClass(cComChilkatBinData)) To hoJpgData
    If (Not(IsComObjectCreated(hoJpgData))) Begin
        Send CreateComObject of hoJpgData
    End
    Get pvComObject of hoJpgData to vJpgData
    Get ComQuickGetBd Of hoHttp sRefUri vJpgData To iSuccess
    If (iSuccess <> True) Begin
        Get ComLastErrorText Of hoHttp To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Provide the JPG data to the verifier
    Get pvComObject of hoJpgData to vJpgData
    Get ComSetRefDataBd Of hoVerifier 0 vJpgData To iSuccess

    // Verify the signature
    Get ComVerifySignature Of hoVerifier True To iBVerified
    Showln "Signature verified = " iBVerified


End_Procedure