(Visual FoxPro) Verify an XML Signature with Multiple References

Demonstrates how to verify an XML digital signature that contains multiple references.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL loHttp
LOCAL loSbXml
LOCAL lnSuccess
LOCAL loVerifier
LOCAL lnVerifyReferenceDigests
LOCAL lnVerified
LOCAL lnSignedInfoVerified
LOCAL lnNumRefs
LOCAL i
LOCAL lnRefDigestVerified

* This example requires the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* An example of an enveloping XML signature with mulitple references is available at
* https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml

* This example will show how to verify the signature and all references, and also how
* to verify each reference individually.  This is useful to distinguish which part
* of the XML signature validation failed.  It could be that one or more of the references
* failed because of a hash computation mismatch.  Or it could be that the signature over
* the SignedInfo failed.  

* First, let's grab the sample XML signature.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Http')
loHttp = CreateObject('Chilkat.Http')
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbXml = CreateObject('Chilkat.StringBuilder')
lnSuccess = loHttp.QuickGetSb("https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml",loSbXml)
IF (lnSuccess <> 1) THEN
    ? loHttp.LastErrorText
    RELEASE loHttp
    RELEASE loSbXml
    CANCEL
ENDIF

* Load the XML containing the signature to be verified.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.XmlDSig')
loVerifier = CreateObject('Chilkat.XmlDSig')
lnSuccess = loVerifier.LoadSignatureSb(loSbXml)
IF (lnSuccess <> 1) THEN
    ? loVerifier.LastErrorText
    RELEASE loHttp
    RELEASE loSbXml
    RELEASE loVerifier
    CANCEL
ENDIF

lnVerifyReferenceDigests = 1

* The quick way to validate all references and the signature over the SignedInfo
* is to call VerifySignature with verifyReferenceDigests equal to 1.
lnVerified = loVerifier.VerifySignature(lnVerifyReferenceDigests)
? "Signature and all reference digests verified = " + STR(lnVerified)

* Let's pretend the call to VerifySignature returned 0.  Something did not validate.
* Was it one or more of the References that did not hash to the correct value?
* Or was it the signature over the SignedInfo that failed?
* We can check just the signature over the SignedInfo by passing 0 to VerifySignature.
* This allows us to skip the hashing and checking each Reference.  
lnVerifyReferenceDigests = 0
lnSignedInfoVerified = loVerifier.VerifySignature(lnVerifyReferenceDigests)
? "Neglecting the reference hashes, the SignedInfo validation result = " + STR(lnSignedInfoVerified)

* We can also verify each reference digest separately
lnNumRefs = loVerifier.NumReferences
i = 0
DO WHILE i < lnNumRefs
    lnRefDigestVerified = loVerifier.VerifyReferenceDigest(i)
    ? "Reference " + STR(i) + " digest verified = " + STR(lnRefDigestVerified)
    i = i + 1
ENDDO

* For this sample XML signature with 3 References, we get the following output:

* Signature and all reference digests verified = True
* Neglecting the reference hashes, the SignedInfo validation result = True
* Reference 0 digest verified = True
* Reference 1 digest verified = True
* Reference 2 digest verified = Tru

RELEASE loHttp
RELEASE loSbXml
RELEASE loVerifier