(Delphi DLL) XML-DSig Add Reference with Transforms Specified Explicitly

Demonstrates how to use the new AddSameDocRef2 method to explicitly specify the XML Transforms fragment.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, StringBuilder, XmlDSigGen, Xml, XmlDSig, Cert;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Boolean;
xmlToSign: HCkXml;
gen: HCkXmlDSigGen;
object1: HCkXml;
xml1: HCkXml;
cert: HCkCert;
sbXml: HCkStringBuilder;
verifier: HCkXmlDSig;
numSigs: Integer;
verifyIdx: Integer;
verified: Boolean;

begin
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

success := True;

// Create the following XML to be signed:

// <doc>
//     <s id="s1">Some text...</s>
//     <p>Some text...</p>
//     <p class="note">A note...</p>
// </doc>

// Use this online tool to generate code from sample XML: 
// Generate Code to Create XML

xmlToSign := CkXml_Create();
CkXml_putTag(xmlToSign,'doc');
CkXml_UpdateAttrAt(xmlToSign,'s',True,'id','s1');
CkXml_UpdateChildContent(xmlToSign,'s','Some text...');
CkXml_UpdateChildContent(xmlToSign,'p','Some text...');
CkXml_UpdateAttrAt(xmlToSign,'p[1]',True,'class','note');
CkXml_UpdateChildContent(xmlToSign,'p[1]','A note...');

Memo1.Lines.Add(CkXml__getXml(xmlToSign));

gen := CkXmlDSigGen_Create();

CkXmlDSigGen_putSigLocation(gen,'doc');
CkXmlDSigGen_putSigLocationMod(gen,0);
CkXmlDSigGen_putSigId(gen,'Signature-78f29839-06af-448f-b479-ca46457fab1b-Signature');
CkXmlDSigGen_putSigNamespacePrefix(gen,'ds');
CkXmlDSigGen_putSigNamespaceUri(gen,'http://www.w3.org/2000/09/xmldsig#');
CkXmlDSigGen_putSigValueId(gen,'Signature-78f29839-06af-448f-b479-ca46457fab1b-SignatureValue');
CkXmlDSigGen_putSignedInfoCanonAlg(gen,'C14N');
CkXmlDSigGen_putSignedInfoDigestMethod(gen,'sha1');

// Set the KeyInfoId before adding references..
CkXmlDSigGen_putKeyInfoId(gen,'Signature-78f29839-06af-448f-b479-ca46457fab1b-KeyInfo');

// The following XML to be added as an Object to the Signature

// Use this online tool to generate code from sample XML: 
// Generate Code to Create XML

// <xades:QualifyingProperties Id="Signature-78f29839-06af-448f-b479-ca46457fab1b-QualifyingProperties" Target="#Signature-78f29839-06af-448f-b479-ca46457fab1b-Signature" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xades="http://uri.etsi.org/01903/v1.3.2#">
//     <xades:SignedProperties Id="Signature-78f29839-06af-448f-b479-ca46457fab1b-SignedProperties">
//         <xades:SignedSignatureProperties>
//             <xades:SigningTime>TO BE GENERATED BY CHILKAT</xades:SigningTime>
//             <xades:SigningCertificate>
//                 <xades:Cert>
//                     <xades:CertDigest>
//                         <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
//                         <ds:DigestValue>TO BE GENERATED BY CHILKAT</ds:DigestValue>
//                     </xades:CertDigest>
//                     <xades:IssuerSerial>
//                         <ds:X509IssuerName>TO BE GENERATED BY CHILKAT</ds:X509IssuerName>
//                         <ds:X509SerialNumber>TO BE GENERATED BY CHILKAT</ds:X509SerialNumber>
//                     </xades:IssuerSerial>
//                 </xades:Cert>
//             </xades:SigningCertificate>
//         </xades:SignedSignatureProperties>
//         <xades:SignedDataObjectProperties>
//             <xades:DataObjectFormat ObjectReference="#Reference-24eb6003-d41c-442c-a731-d4c58f94790b">
//                 <xades:Description/>
//                 <xades:ObjectIdentifier>
//                     <xades:Identifier Qualifier="OIDAsURN">urn:oid:1.2.840.10003.5.109.10</xades:Identifier>
//                     <xades:Description/>
//                 </xades:ObjectIdentifier>
//                 <xades:MimeType>text/xml</xades:MimeType>
//                 <xades:Encoding/>
//             </xades:DataObjectFormat>
//         </xades:SignedDataObjectProperties>
//     </xades:SignedProperties>
// </xades:QualifyingProperties>

object1 := CkXml_Create();
CkXml_putTag(object1,'xades:QualifyingProperties');
CkXml_AddAttribute(object1,'Id','Signature-78f29839-06af-448f-b479-ca46457fab1b-QualifyingProperties');
CkXml_AddAttribute(object1,'Target','#Signature-78f29839-06af-448f-b479-ca46457fab1b-Signature');
CkXml_AddAttribute(object1,'xmlns:ds','http://www.w3.org/2000/09/xmldsig#');
CkXml_AddAttribute(object1,'xmlns:xades','http://uri.etsi.org/01903/v1.3.2#');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties',True,'Id','Signature-78f29839-06af-448f-b479-ca46457fab1b-SignedProperties');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningTime','TO BE GENERATED BY CHILKAT');
// Note: It may be that http://www.w3.org/2001/04/xmlenc#sha256 is needed in the following line instead of http://www.w3.org/2000/09/xmldsig#sha1
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestMethod',True,'Algorithm','http://www.w3.org/2000/09/xmldsig#sha1');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:CertDigest|ds:DigestValue','TO BE GENERATED BY CHILKAT');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedSignatureProperties|xades:SigningCertificateV2|xades:Cert|xades:IssuerSerialV2','TO BE GENERATED BY CHILKAT');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat',True,'ObjectReference','#Reference-24eb6003-d41c-442c-a731-d4c58f94790b');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:Description','');
CkXml_UpdateAttrAt(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Identifier',True,'Qualifier','OIDAsURN');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Identifier','urn:oid:1.2.840.10003.5.109.10');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:ObjectIdentifier|xades:Description','');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:MimeType','text/xml');
CkXml_UpdateChildContent(object1,'xades:SignedProperties|xades:SignedDataObjectProperties|xades:DataObjectFormat|xades:Encoding','');

Memo1.Lines.Add(CkXml__getXml(object1));

CkXmlDSigGen_AddObject(gen,'',CkXml__getXml(object1),'','');

// -------- Reference 1 --------

// Create the following Transforms fragment:

// Use this online tool to generate code from sample XML: 
// Generate Code to Create XML

// <ds:Transforms>
//     <ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
//     <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
//     <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
//         <ds:XPath xmlns:ds="http://www.w3.org/2000/09/xmldsig#">not(ancestor-or-self::ds:Signature)</ds:XPath>
//     </ds:Transform>
// </ds:Transforms>

xml1 := CkXml_Create();
CkXml_putTag(xml1,'ds:Transforms');
CkXml_UpdateAttrAt(xml1,'ds:Transform',True,'Algorithm','http://www.w3.org/TR/2001/REC-xml-c14n-20010315');
CkXml_UpdateAttrAt(xml1,'ds:Transform[1]',True,'Algorithm','http://www.w3.org/2000/09/xmldsig#enveloped-signature');
CkXml_UpdateAttrAt(xml1,'ds:Transform[2]',True,'Algorithm','http://www.w3.org/TR/1999/REC-xpath-19991116');
CkXml_UpdateAttrAt(xml1,'ds:Transform[2]|ds:XPath',True,'xmlns:ds','http://www.w3.org/2000/09/xmldsig#');
CkXml_UpdateChildContent(xml1,'ds:Transform[2]|ds:XPath','not(ancestor-or-self::ds:Signature)');

// This is the "Transforms" XML fragment passed to AddSameDocRef2.
Memo1.Lines.Add(CkXml__getXml(xml1));

CkXmlDSigGen_AddSameDocRef2(gen,'','sha1',xml1,'');

CkXmlDSigGen_SetRefIdAttr(gen,'','Reference-24eb6003-d41c-442c-a731-d4c58f94790b');

// -------- Reference 2 --------
CkXmlDSigGen_AddObjectRef(gen,'Signature-78f29839-06af-448f-b479-ca46457fab1b-SignedProperties','sha1','','','http://uri.etsi.org/01903#SignedProperties');

// -------- Reference 3 --------
CkXmlDSigGen_AddSameDocRef(gen,'Signature-78f29839-06af-448f-b479-ca46457fab1b-KeyInfo','sha1','','','');

// Provide a certificate + private key. (PFX password is test123)
cert := CkCert_Create();
success := CkCert_LoadPfxFile(cert,'qa_data/pfx/cert_test123.pfx','test123');
if (success <> True) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;
CkXmlDSigGen_SetX509Cert(gen,cert,True);

CkXmlDSigGen_putKeyInfoType(gen,'X509Data+KeyValue');
CkXmlDSigGen_putX509Type(gen,'CertChain');

// Load XML to be signed...
sbXml := CkStringBuilder_Create();
CkXml_GetXmlSb(xmlToSign,sbXml);

CkXmlDSigGen_putBehaviors(gen,'IndentedSignature');

// Sign the XML...
success := CkXmlDSigGen_CreateXmlDSigSb(gen,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    Exit;
  end;
// -----------------------------------------------

// Save the signed XML to a file.
success := CkStringBuilder_WriteFile(sbXml,'qa_output/signedXml.xml','utf-8',False);

Memo1.Lines.Add(CkStringBuilder__getAsString(sbXml));

// ----------------------------------------
// Verify the signatures we just produced...
verifier := CkXmlDSig_Create();
success := CkXmlDSig_LoadSignatureSb(verifier,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
    Exit;
  end;

numSigs := CkXmlDSig_getNumSignatures(verifier);
verifyIdx := 0;
while verifyIdx < numSigs do
  begin
    CkXmlDSig_putSelector(verifier,verifyIdx);
    verified := CkXmlDSig_VerifySignature(verifier,True);
    if (verified <> True) then
      begin
        Memo1.Lines.Add(CkXmlDSig__lastErrorText(verifier));
        Exit;
      end;
    verifyIdx := verifyIdx + 1;
  end;

Memo1.Lines.Add('All signatures were successfully verified.');

CkXml_Dispose(xmlToSign);
CkXmlDSigGen_Dispose(gen);
CkXml_Dispose(object1);
CkXml_Dispose(xml1);
CkCert_Dispose(cert);
CkStringBuilder_Dispose(sbXml);
CkXmlDSig_Dispose(verifier);

end;