(Objective-C) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoXmlDSig.h>
#import <CkoHttp.h>
#import <CkoStringBuilder.h>
#import <CkoBinData.h>

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

CkoXmlDSig *verifier = [[CkoXmlDSig alloc] init];
CkoHttp *http = [[CkoHttp alloc] init];

// First load the signed XML
CkoStringBuilder *sbSignedXml = [[CkoStringBuilder alloc] init];
BOOL success = [sbSignedXml LoadFile: @"qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml" charset: @"utf-8"];
if (success == NO) {
    NSLog(@"%@",@"Failed to load signed XML.");
    return;
}

success = [verifier LoadSignatureSb: sbSignedXml];
if (success == NO) {
    NSLog(@"%@",verifier.LastErrorText);
    return;
}

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
CkoStringBuilder *sbRefUri = [[CkoStringBuilder alloc] init];
CkoBinData *bd = [[CkoBinData alloc] init];
int numRefs = [verifier.NumReferences intValue];
int i = 0;
while (i < numRefs) {
    if ([verifier IsReferenceExternal: [NSNumber numberWithInt: i]] == YES) {
        [sbRefUri Clear];
        [sbRefUri Append: [verifier ReferenceUri: [NSNumber numberWithInt: i]]];
        if ([sbRefUri StartsWith: @"https://" caseSensitive: NO] == YES) {
            NSLog(@"%@%@",@"External URL Reference: ",[sbRefUri GetAsString]);

            // Download the data at the URL and provide to the verifier.
            success = [http DownloadBd: [sbRefUri GetAsString] binData: bd];
            if (success == NO) {
                NSLog(@"%@",http.LastErrorText);
                return;
            }

            success = [verifier SetRefDataBd: [NSNumber numberWithInt: i] binData: bd];
            if (success == NO) {
                NSLog(@"%@",verifier.LastErrorText);
                return;
            }

        }

    }

    i = i + 1;
}

// Now that we have the external data, verify the signature..
BOOL bVerified = [verifier VerifySignature: YES];
if (bVerified == NO) {
    NSLog(@"%@",verifier.LastErrorText);
}

NSLog(@"%@%d",@"Signature verified = ",bVerified);