(Visual FoxPro) ZATCA QR Code TLV Encoding and ECDSA Cryptographic Stamp

See more ZATCA Examples

Demonstrates how to create the TLV encoding of the QR code fields, then apply the ECDSA signature and ECDSA public key, and finally insert into the previously signed XML E-Invoice.

Note: This example requires Chilkat v9.5.0.92 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL lnSuccess
LOCAL lcSellerName
LOCAL lcVatNumber
LOCAL loDt
LOCAL lcTimeStamp
LOCAL lcInvoiceTotal
LOCAL lcVatTotal
LOCAL loBdTlv
LOCAL lcCharset
LOCAL lnTag
LOCAL lcSignedXmlFilePath
LOCAL loXmlSigned
LOCAL loSbDigestValue
LOCAL loSbSignatureValue
LOCAL lcX509Certificate
LOCAL loCert
LOCAL loBdPubKey
LOCAL loBdCertSig
LOCAL lcQr_base64
LOCAL loXmlQR
LOCAL loSbSignedXml
LOCAL loSbReplaceStr
LOCAL loVerifier
LOCAL lnNumSigs
LOCAL lnVerifyIdx
LOCAL lnVerified

* This example requires the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* In Step 1, we applied a signature to an e-invoice Zakat, Tax and Customs Authority (ZATCA) of Saudi Arabia

* This example is Step 2, where we compose the TLV encoding of the QR code, apply the ECDSA signature, and then insert into the signed XML without disturbing the signed XML.

* Construct TLV (Tag-Length-Value) encoding of the QR data.
* We have 5 pieces of data: Seller Name, VAT Number, Time Stamp, Invoice Total, and VAT Total.
* For example:
lcSellerName = "Firoz Ashraf"
lcVatNumber = "1234567891"

* The timestamp in QR Code should be based on Invoice Issue Time (KSA-25) and Invoice Issue Date (BT-2). 
* It can either be in format YYYY-MM-DD'T'HH:MM:SS (for local time in KSA) or YYYY-MM-DD'T'HH:MM:SS'Z' (for UTC time or Zulu time)

* Get the current UTC date/time in this format: YYYY-MM-DD'T'HH:MM:SS'Z'
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.CkDateTime')
loDt = CreateObject('Chilkat.CkDateTime')
loDt.SetFromCurrentSystemTime()
lcTimeStamp = loDt.GetAsTimestamp(0)
lcInvoiceTotal = "100.00"
lcVatTotal = "15.00"

* TLV encode into a Chilkat BinData object.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.BinData')
loBdTlv = CreateObject('Chilkat.BinData')

lcCharset = "utf-8"

lnTag = 1
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendCountedString(1,0,lcSellerName,lcCharset)
lnTag = lnTag + 1
* This is tag 2
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendCountedString(1,0,lcVatNumber,lcCharset)
lnTag = lnTag + 1
* This is tag 3
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendCountedString(1,0,lcTimeStamp,lcCharset)
lnTag = lnTag + 1
* This is tag 4
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendCountedString(1,0,lcInvoiceTotal,lcCharset)
lnTag = lnTag + 1
* This is tag 5
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendCountedString(1,0,lcVatTotal,lcCharset)

* ----------------------------------------------------------------------------------------------------------------------------------------------
* For tag 6, we need the SHA256 hash from the signed XML.  This is the DigestValue as shown in the fragment of the XML Signature below:

*     <ds:Reference Id="invoiceSignedData" URI="">
*         <ds:Transforms>
*             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
*                 <ds:XPath>not(//ancestor-or-self::ext:UBLExtensions)</ds:XPath>
*             </ds:Transform>
*             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
*                 <ds:XPath>not(//ancestor-or-self::cac:Signature)</ds:XPath>
*             </ds:Transform>
*             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
*                 <ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
*             </ds:Transform>
*             <ds:Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
*         </ds:Transforms>
*         <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
*         <ds:DigestValue>zCp+kF1qzNgXD6AhLq69/CYCklMFSXUmmVPbm4v/76U=</ds:DigestValue>
*     </ds:Reference>

* To get this information, we'll need to load the signed XML into a Chilkat XML object, and then access it.
* Load the XML we previously signed...
lcSignedXmlFilePath = "qa_data/zatca/testing/SignedXML.xml"
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Xml')
loXmlSigned = CreateObject('Chilkat.Xml')
lnSuccess = loXmlSigned.LoadXmlFile(lcSignedXmlFilePath)
IF (lnSuccess = 0) THEN
    ? loXmlSigned.LastErrorText
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    CANCEL
ENDIF

* digestValue is a base64 string.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbDigestValue = CreateObject('Chilkat.StringBuilder')
lnSuccess = loXmlSigned.GetChildContentSb("ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:SignedInfo|ds:Reference[0]|ds:DigestValue",loSbDigestValue)
IF (lnSuccess = 0) THEN
    ? "Failed to get DigestValue from signed XML."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    CANCEL
ENDIF

? "DigestValue = " + loSbDigestValue.GetAsString()

* Append the DigestValue base64 string to the TLV.
lnTag = 6
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendByte(loSbDigestValue.Length)
loBdTlv.AppendSb(loSbDigestValue,"utf-8")

* ----------------------------------------------------------------------------------------------------------------------------------------------
* Tag 7 will contain the <ds:Signature> value from the signed XML.
* PS> To get the XML path passed to GetChildContentSb, you can copy/paste the signed XML into Chilkat's online tool at https://tools.chilkat.io/xmlParse
* The parsing code that is generated by the online tool will reveal the required path to the element in the XML.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbSignatureValue = CreateObject('Chilkat.StringBuilder')
lnSuccess = loXmlSigned.GetChildContentSb("ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:SignatureValue",loSbSignatureValue)
IF (lnSuccess = 0) THEN
    ? "Failed to get SignatureValue from signed XML."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    CANCEL
ENDIF

? "SignatureValue = " + loSbSignatureValue.GetAsString()

* Append the SignatureValue base64 string to the TLV.
lnTag = 7
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendByte(loSbSignatureValue.Length)
loBdTlv.AppendSb(loSbSignatureValue,"utf-8")

* ----------------------------------------------------------------------------------------------------------------------------------------------
* Tag 8 will contain the public key of the signing certificate.
* The signing certificate is available within the signed XML at <ds:X509Certificate>.
lcX509Certificate = loXmlSigned.GetChildContent("ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:KeyInfo|ds:X509Data|ds:X509Certificate")
IF (loXmlSigned.LastMethodSuccess = 0) THEN
    ? "Failed to get X509Certificate from the signed XML."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    CANCEL
ENDIF

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Cert')
loCert = CreateObject('Chilkat.Cert')
lnSuccess = loCert.SetFromEncoded(lcX509Certificate)
IF (lnSuccess = 0) THEN
    ? "Failed to load signing certificate from base64."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    RELEASE loCert
    CANCEL
ENDIF

* We want to get the cert's public key bytes having this ASN.1 format.
* SEQUENCE (2 elem)
*   SEQUENCE (2 elem)
*     OBJECT IDENTIFIER 1.2.840.10045.2.1 ecPublicKey (ANSI X9.62 public key type)
*     OBJECT IDENTIFIER 1.3.132.0.10 secp256k1 (SECG (Certicom) named elliptic curve)
*   BIT STRING (520 bit) 0000010001110000110111000001111110100110101110110101111000110001110100

* Note: The cert.GetPubKeyDer method was added in Chilkat v9.5.0.92
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.BinData')
loBdPubKey = CreateObject('Chilkat.BinData')
lnSuccess = loCert.GetPubKeyDer(1,loBdPubKey)
IF (lnSuccess = 0) THEN
    ? "Failed to get certificate's public key."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    RELEASE loCert
    RELEASE loBdPubKey
    CANCEL
ENDIF

* We want to add the binary bytes of the public key (not the base64 string) to the QR code.
lnTag = 8
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendByte(loBdPubKey.NumBytes)
loBdTlv.AppendBd(loBdPubKey)

* Show the public key in base64 format:
? "Certificate public key:"
? loBdPubKey.GetEncoded("base64")

* ----------------------------------------------------------------------------------------------------------------------------------------------
* Tag 9 will contain the signature contained in the signing certificate.

* Note: The cert.GetPubKeyDer method was added in Chilkat v9.5.0.92
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.BinData')
loBdCertSig = CreateObject('Chilkat.BinData')
lnSuccess = loCert.GetSignature(loBdCertSig)
IF (lnSuccess = 0) THEN
    ? "Failed to get certificate's signature."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    RELEASE loCert
    RELEASE loBdPubKey
    RELEASE loBdCertSig
    CANCEL
ENDIF

* We want to add the binary bytes of the signature (not the base64 string) to the QR code.
lnTag = 9
loBdTlv.AppendByte(lnTag)
loBdTlv.AppendByte(loBdCertSig.NumBytes)
loBdTlv.AppendBd(loBdCertSig)

* Show the cert's signature in hex format:
? "Certificate signature:"
? loBdCertSig.GetEncoded("hex")

* ----------------------------------------------------------------------------------------------------------------------------------------------
* At this point the full QR code is contained in bdTlv.
* Get it as a base64 string
lcQr_base64 = loBdTlv.GetEncoded("base64")
? "QR: " + lcQr_base64

* ----------------------------------------------------------------------------------------------------------------------------------------------
* Insert the QR XML fragment into the previously signed XML -- without disturbing (invalidating) the signature.

* We need to build and insert the following XML fragment under the 
* as a cac:AdditionalDocumentReference just before the "<cac:Signature>" opening tag.

*    <cac:AdditionalDocumentReference>
*         <cbc:ID>QR</cbc:ID>
*         <cac:Attachment>
*             <cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">BASE64_TLV_CONTENT</cbc:EmbeddedDocumentBinaryObject>
*         </cac:Attachment>
*    </cac:AdditionalDocumentReference>

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Xml')
loXmlQR = CreateObject('Chilkat.Xml')
loXmlQR.Tag = "cac:AdditionalDocumentReference"
loXmlQR.UpdateChildContent("cbc:ID","QR")
loXmlQR.UpdateAttrAt("cac:Attachment|cbc:EmbeddedDocumentBinaryObject",1,"mimeCode","text/plain")
loXmlQR.UpdateChildContent("cac:Attachment|cbc:EmbeddedDocumentBinaryObject",loBdTlv.GetEncoded("base64"))

* Load our previously signed XML into a Chilkat StringBuilder.
* We should not load the previously signed XML into a Chilkat XML object because the XML gets loaded into an internal DOM (Document Object Model).
* When re-emitted from the DOM, formatting can change and it would break the XML signature.
* Therefore, we must load into a StringBuilder and insert the new fragment without disturbing the remainder.
* The inserted fragment is ignored because the following transform was included in the XML signature reference:

*             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
*                 <ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
*             </ds:Transform>

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbSignedXml = CreateObject('Chilkat.StringBuilder')
lnSuccess = loSbSignedXml.LoadFile(lcSignedXmlFilePath,"utf-8")
IF (lnSuccess = 0) THEN
    ? "Failed to load previously signed XML file."
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    RELEASE loCert
    RELEASE loBdPubKey
    RELEASE loBdCertSig
    RELEASE loXmlQR
    RELEASE loSbSignedXml
    CANCEL
ENDIF

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbReplaceStr = CreateObject('Chilkat.StringBuilder')
loXmlQR.EmitXmlDecl = 0
loXmlQR.EmitCompact = 1
loSbReplaceStr.Append(loXmlQR.GetXml())
loSbReplaceStr.Append("<cac:Signature>")
lnSuccess = loSbSignedXml.ReplaceFirst("<cac:Signature>",loSbReplaceStr.GetAsString())
IF (lnSuccess = 0) THEN
    ? "Did not find <cac:Signature> in the signed XML"
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    RELEASE loCert
    RELEASE loBdPubKey
    RELEASE loBdCertSig
    RELEASE loXmlQR
    RELEASE loSbSignedXml
    RELEASE loSbReplaceStr
    CANCEL
ENDIF

* Save the updated signed XML.
lnSuccess = loSbSignedXml.WriteFile("qa_output/signedXML_withQR.xml","utf-8",0)

* ----------------------------------------
* Verify the updated signed XML to make sure we didn't invalidate the signature...
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.XmlDSig')
loVerifier = CreateObject('Chilkat.XmlDSig')
lnSuccess = loVerifier.LoadSignatureSb(loSbSignedXml)
IF (lnSuccess <> 1) THEN
    ? loVerifier.LastErrorText
    RELEASE loDt
    RELEASE loBdTlv
    RELEASE loXmlSigned
    RELEASE loSbDigestValue
    RELEASE loSbSignatureValue
    RELEASE loCert
    RELEASE loBdPubKey
    RELEASE loBdCertSig
    RELEASE loXmlQR
    RELEASE loSbSignedXml
    RELEASE loSbReplaceStr
    RELEASE loVerifier
    CANCEL
ENDIF

* ---------------- This is important -----------------------------------------
* Starting in Chilkat v9.5.0.92, specify "ZATCA" in uncommon options 
* to validate signed XML according to ZATCA needs.
* ----------------------------------------------------------------------------
loVerifier.UncommonOptions = "ZATCA"

lnNumSigs = loVerifier.NumSignatures
lnVerifyIdx = 0
DO WHILE lnVerifyIdx < lnNumSigs
    loVerifier.Selector = lnVerifyIdx
    lnVerified = loVerifier.VerifySignature(1)
    IF (lnVerified <> 1) THEN
        ? loVerifier.LastErrorText
        RELEASE loDt
        RELEASE loBdTlv
        RELEASE loXmlSigned
        RELEASE loSbDigestValue
        RELEASE loSbSignatureValue
        RELEASE loCert
        RELEASE loBdPubKey
        RELEASE loBdCertSig
        RELEASE loXmlQR
        RELEASE loSbSignedXml
        RELEASE loSbReplaceStr
        RELEASE loVerifier
        CANCEL
    ENDIF

    lnVerifyIdx = lnVerifyIdx + 1
ENDDO
? "All signatures were successfully verified."

RELEASE loDt
RELEASE loBdTlv
RELEASE loXmlSigned
RELEASE loSbDigestValue
RELEASE loSbSignatureValue
RELEASE loCert
RELEASE loBdPubKey
RELEASE loBdCertSig
RELEASE loXmlQR
RELEASE loSbSignedXml
RELEASE loSbReplaceStr
RELEASE loVerifier