(PowerBuilder) ZATCA QR Code TLV Encoding and ECDSA Cryptographic Stamp

See more ZATCA Examples

Demonstrates how to create the TLV encoding of the QR code fields, then apply the ECDSA signature and ECDSA public key, and finally insert into the previously signed XML E-Invoice.

Note: This example requires Chilkat v9.5.0.92 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

integer li_rc
integer li_Success
string ls_SellerName
string ls_VatNumber
oleobject loo_Dt
string ls_TimeStamp
string ls_InvoiceTotal
string ls_VatTotal
oleobject loo_BdTlv
string ls_Charset
integer li_Tag
string ls_SignedXmlFilePath
oleobject loo_XmlSigned
oleobject loo_SbDigestValue
oleobject loo_SbSignatureValue
string ls_X509Certificate
oleobject loo_Cert
oleobject loo_BdPubKey
oleobject loo_BdCertSig
string ls_Qr_base64
oleobject loo_XmlQR
oleobject loo_SbSignedXml
oleobject loo_SbReplaceStr
oleobject loo_Verifier
integer li_NumSigs
integer li_VerifyIdx
integer li_Verified

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// In Step 1, we applied a signature to an e-invoice Zakat, Tax and Customs Authority (ZATCA) of Saudi Arabia

// This example is Step 2, where we compose the TLV encoding of the QR code, apply the ECDSA signature, and then insert into the signed XML without disturbing the signed XML.

// Construct TLV (Tag-Length-Value) encoding of the QR data.
// We have 5 pieces of data: Seller Name, VAT Number, Time Stamp, Invoice Total, and VAT Total.
// For example:
ls_SellerName = "Firoz Ashraf"
ls_VatNumber = "1234567891"

// The timestamp in QR Code should be based on Invoice Issue Time (KSA-25) and Invoice Issue Date (BT-2). 
// It can either be in format YYYY-MM-DD'T'HH:MM:SS (for local time in KSA) or YYYY-MM-DD'T'HH:MM:SS'Z' (for UTC time or Zulu time)

// Get the current UTC date/time in this format: YYYY-MM-DD'T'HH:MM:SS'Z'
loo_Dt = create oleobject
// Use "Chilkat_9_5_0.CkDateTime" for versions of Chilkat < 10.0.0
li_rc = loo_Dt.ConnectToNewObject("Chilkat.CkDateTime")
if li_rc < 0 then
    destroy loo_Dt
    MessageBox("Error","Connecting to COM object failed")
    return
end if
loo_Dt.SetFromCurrentSystemTime()
ls_TimeStamp = loo_Dt.GetAsTimestamp(0)
ls_InvoiceTotal = "100.00"
ls_VatTotal = "15.00"

// TLV encode into a Chilkat BinData object.
loo_BdTlv = create oleobject
// Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
li_rc = loo_BdTlv.ConnectToNewObject("Chilkat.BinData")

ls_Charset = "utf-8"

li_Tag = 1
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendCountedString(1,0,ls_SellerName,ls_Charset)
li_Tag = li_Tag + 1
// This is tag 2
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendCountedString(1,0,ls_VatNumber,ls_Charset)
li_Tag = li_Tag + 1
// This is tag 3
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendCountedString(1,0,ls_TimeStamp,ls_Charset)
li_Tag = li_Tag + 1
// This is tag 4
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendCountedString(1,0,ls_InvoiceTotal,ls_Charset)
li_Tag = li_Tag + 1
// This is tag 5
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendCountedString(1,0,ls_VatTotal,ls_Charset)

// ----------------------------------------------------------------------------------------------------------------------------------------------
// For tag 6, we need the SHA256 hash from the signed XML.  This is the DigestValue as shown in the fragment of the XML Signature below:

//     <ds:Reference Id="invoiceSignedData" URI="">
//         <ds:Transforms>
//             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
//                 <ds:XPath>not(//ancestor-or-self::ext:UBLExtensions)</ds:XPath>
//             </ds:Transform>
//             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
//                 <ds:XPath>not(//ancestor-or-self::cac:Signature)</ds:XPath>
//             </ds:Transform>
//             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
//                 <ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
//             </ds:Transform>
//             <ds:Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
//         </ds:Transforms>
//         <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//         <ds:DigestValue>zCp+kF1qzNgXD6AhLq69/CYCklMFSXUmmVPbm4v/76U=</ds:DigestValue>
//     </ds:Reference>

// To get this information, we'll need to load the signed XML into a Chilkat XML object, and then access it.
// Load the XML we previously signed...
ls_SignedXmlFilePath = "qa_data/zatca/testing/SignedXML.xml"
loo_XmlSigned = create oleobject
// Use "Chilkat_9_5_0.Xml" for versions of Chilkat < 10.0.0
li_rc = loo_XmlSigned.ConnectToNewObject("Chilkat.Xml")

li_Success = loo_XmlSigned.LoadXmlFile(ls_SignedXmlFilePath)
if li_Success = 0 then
    Write-Debug loo_XmlSigned.LastErrorText
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    return
end if

// digestValue is a base64 string.
loo_SbDigestValue = create oleobject
// Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
li_rc = loo_SbDigestValue.ConnectToNewObject("Chilkat.StringBuilder")

li_Success = loo_XmlSigned.GetChildContentSb("ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:SignedInfo|ds:Reference[0]|ds:DigestValue",loo_SbDigestValue)
if li_Success = 0 then
    Write-Debug "Failed to get DigestValue from signed XML."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    return
end if

Write-Debug "DigestValue = " + loo_SbDigestValue.GetAsString()

// Append the DigestValue base64 string to the TLV.
li_Tag = 6
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendByte(loo_SbDigestValue.Length)
loo_BdTlv.AppendSb(loo_SbDigestValue,"utf-8")

// ----------------------------------------------------------------------------------------------------------------------------------------------
// Tag 7 will contain the <ds:Signature> value from the signed XML.
// PS> To get the XML path passed to GetChildContentSb, you can copy/paste the signed XML into Chilkat's online tool at https://tools.chilkat.io/xmlParse
// The parsing code that is generated by the online tool will reveal the required path to the element in the XML.
loo_SbSignatureValue = create oleobject
// Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
li_rc = loo_SbSignatureValue.ConnectToNewObject("Chilkat.StringBuilder")

li_Success = loo_XmlSigned.GetChildContentSb("ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:SignatureValue",loo_SbSignatureValue)
if li_Success = 0 then
    Write-Debug "Failed to get SignatureValue from signed XML."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    return
end if

Write-Debug "SignatureValue = " + loo_SbSignatureValue.GetAsString()

// Append the SignatureValue base64 string to the TLV.
li_Tag = 7
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendByte(loo_SbSignatureValue.Length)
loo_BdTlv.AppendSb(loo_SbSignatureValue,"utf-8")

// ----------------------------------------------------------------------------------------------------------------------------------------------
// Tag 8 will contain the public key of the signing certificate.
// The signing certificate is available within the signed XML at <ds:X509Certificate>.
ls_X509Certificate = loo_XmlSigned.GetChildContent("ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:KeyInfo|ds:X509Data|ds:X509Certificate")
if loo_XmlSigned.LastMethodSuccess = 0 then
    Write-Debug "Failed to get X509Certificate from the signed XML."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    return
end if

loo_Cert = create oleobject
// Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
li_rc = loo_Cert.ConnectToNewObject("Chilkat.Cert")

li_Success = loo_Cert.SetFromEncoded(ls_X509Certificate)
if li_Success = 0 then
    Write-Debug "Failed to load signing certificate from base64."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    destroy loo_Cert
    return
end if

// We want to get the cert's public key bytes having this ASN.1 format.
// SEQUENCE (2 elem)
//   SEQUENCE (2 elem)
//     OBJECT IDENTIFIER 1.2.840.10045.2.1 ecPublicKey (ANSI X9.62 public key type)
//     OBJECT IDENTIFIER 1.3.132.0.10 secp256k1 (SECG (Certicom) named elliptic curve)
//   BIT STRING (520 bit) 0000010001110000110111000001111110100110101110110101111000110001110100

// Note: The cert.GetPubKeyDer method was added in Chilkat v9.5.0.92
loo_BdPubKey = create oleobject
// Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
li_rc = loo_BdPubKey.ConnectToNewObject("Chilkat.BinData")

li_Success = loo_Cert.GetPubKeyDer(1,loo_BdPubKey)
if li_Success = 0 then
    Write-Debug "Failed to get certificate's public key."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    destroy loo_Cert
    destroy loo_BdPubKey
    return
end if

// We want to add the binary bytes of the public key (not the base64 string) to the QR code.
li_Tag = 8
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendByte(loo_BdPubKey.NumBytes)
loo_BdTlv.AppendBd(loo_BdPubKey)

// Show the public key in base64 format:
Write-Debug "Certificate public key:"
Write-Debug loo_BdPubKey.GetEncoded("base64")

// ----------------------------------------------------------------------------------------------------------------------------------------------
// Tag 9 will contain the signature contained in the signing certificate.

// Note: The cert.GetPubKeyDer method was added in Chilkat v9.5.0.92
loo_BdCertSig = create oleobject
// Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
li_rc = loo_BdCertSig.ConnectToNewObject("Chilkat.BinData")

li_Success = loo_Cert.GetSignature(loo_BdCertSig)
if li_Success = 0 then
    Write-Debug "Failed to get certificate's signature."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    destroy loo_Cert
    destroy loo_BdPubKey
    destroy loo_BdCertSig
    return
end if

// We want to add the binary bytes of the signature (not the base64 string) to the QR code.
li_Tag = 9
loo_BdTlv.AppendByte(li_Tag)
loo_BdTlv.AppendByte(loo_BdCertSig.NumBytes)
loo_BdTlv.AppendBd(loo_BdCertSig)

// Show the cert's signature in hex format:
Write-Debug "Certificate signature:"
Write-Debug loo_BdCertSig.GetEncoded("hex")

// ----------------------------------------------------------------------------------------------------------------------------------------------
// At this point the full QR code is contained in bdTlv.
// Get it as a base64 string
ls_Qr_base64 = loo_BdTlv.GetEncoded("base64")
Write-Debug "QR: " + ls_Qr_base64

// ----------------------------------------------------------------------------------------------------------------------------------------------
// Insert the QR XML fragment into the previously signed XML -- without disturbing (invalidating) the signature.

// We need to build and insert the following XML fragment under the 
// as a cac:AdditionalDocumentReference just before the "<cac:Signature>" opening tag.

//    <cac:AdditionalDocumentReference>
//         <cbc:ID>QR</cbc:ID>
//         <cac:Attachment>
//             <cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">BASE64_TLV_CONTENT</cbc:EmbeddedDocumentBinaryObject>
//         </cac:Attachment>
//    </cac:AdditionalDocumentReference>

loo_XmlQR = create oleobject
// Use "Chilkat_9_5_0.Xml" for versions of Chilkat < 10.0.0
li_rc = loo_XmlQR.ConnectToNewObject("Chilkat.Xml")

loo_XmlQR.Tag = "cac:AdditionalDocumentReference"
loo_XmlQR.UpdateChildContent("cbc:ID","QR")
loo_XmlQR.UpdateAttrAt("cac:Attachment|cbc:EmbeddedDocumentBinaryObject",1,"mimeCode","text/plain")
loo_XmlQR.UpdateChildContent("cac:Attachment|cbc:EmbeddedDocumentBinaryObject",loo_BdTlv.GetEncoded("base64"))

// Load our previously signed XML into a Chilkat StringBuilder.
// We should not load the previously signed XML into a Chilkat XML object because the XML gets loaded into an internal DOM (Document Object Model).
// When re-emitted from the DOM, formatting can change and it would break the XML signature.
// Therefore, we must load into a StringBuilder and insert the new fragment without disturbing the remainder.
// The inserted fragment is ignored because the following transform was included in the XML signature reference:

//             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
//                 <ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
//             </ds:Transform>

loo_SbSignedXml = create oleobject
// Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
li_rc = loo_SbSignedXml.ConnectToNewObject("Chilkat.StringBuilder")

li_Success = loo_SbSignedXml.LoadFile(ls_SignedXmlFilePath,"utf-8")
if li_Success = 0 then
    Write-Debug "Failed to load previously signed XML file."
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    destroy loo_Cert
    destroy loo_BdPubKey
    destroy loo_BdCertSig
    destroy loo_XmlQR
    destroy loo_SbSignedXml
    return
end if

loo_SbReplaceStr = create oleobject
// Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
li_rc = loo_SbReplaceStr.ConnectToNewObject("Chilkat.StringBuilder")

loo_XmlQR.EmitXmlDecl = 0
loo_XmlQR.EmitCompact = 1
loo_SbReplaceStr.Append(loo_XmlQR.GetXml())
loo_SbReplaceStr.Append("<cac:Signature>")
li_Success = loo_SbSignedXml.ReplaceFirst("<cac:Signature>",loo_SbReplaceStr.GetAsString())
if li_Success = 0 then
    Write-Debug "Did not find <cac:Signature> in the signed XML"
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    destroy loo_Cert
    destroy loo_BdPubKey
    destroy loo_BdCertSig
    destroy loo_XmlQR
    destroy loo_SbSignedXml
    destroy loo_SbReplaceStr
    return
end if

// Save the updated signed XML.
li_Success = loo_SbSignedXml.WriteFile("qa_output/signedXML_withQR.xml","utf-8",0)

// ----------------------------------------
// Verify the updated signed XML to make sure we didn't invalidate the signature...
loo_Verifier = create oleobject
// Use "Chilkat_9_5_0.XmlDSig" for versions of Chilkat < 10.0.0
li_rc = loo_Verifier.ConnectToNewObject("Chilkat.XmlDSig")

li_Success = loo_Verifier.LoadSignatureSb(loo_SbSignedXml)
if li_Success <> 1 then
    Write-Debug loo_Verifier.LastErrorText
    destroy loo_Dt
    destroy loo_BdTlv
    destroy loo_XmlSigned
    destroy loo_SbDigestValue
    destroy loo_SbSignatureValue
    destroy loo_Cert
    destroy loo_BdPubKey
    destroy loo_BdCertSig
    destroy loo_XmlQR
    destroy loo_SbSignedXml
    destroy loo_SbReplaceStr
    destroy loo_Verifier
    return
end if

// ---------------- This is important -----------------------------------------
// Starting in Chilkat v9.5.0.92, specify "ZATCA" in uncommon options 
// to validate signed XML according to ZATCA needs.
// ----------------------------------------------------------------------------
loo_Verifier.UncommonOptions = "ZATCA"

li_NumSigs = loo_Verifier.NumSignatures
li_VerifyIdx = 0
do while li_VerifyIdx < li_NumSigs
    loo_Verifier.Selector = li_VerifyIdx
    li_Verified = loo_Verifier.VerifySignature(1)
    if li_Verified <> 1 then
        Write-Debug loo_Verifier.LastErrorText
        destroy loo_Dt
        destroy loo_BdTlv
        destroy loo_XmlSigned
        destroy loo_SbDigestValue
        destroy loo_SbSignatureValue
        destroy loo_Cert
        destroy loo_BdPubKey
        destroy loo_BdCertSig
        destroy loo_XmlQR
        destroy loo_SbSignedXml
        destroy loo_SbReplaceStr
        destroy loo_Verifier
        return
    end if

    li_VerifyIdx = li_VerifyIdx + 1
loop
Write-Debug "All signatures were successfully verified."


destroy loo_Dt
destroy loo_BdTlv
destroy loo_XmlSigned
destroy loo_SbDigestValue
destroy loo_SbSignatureValue
destroy loo_Cert
destroy loo_BdPubKey
destroy loo_BdCertSig
destroy loo_XmlQR
destroy loo_SbSignedXml
destroy loo_SbReplaceStr
destroy loo_Verifier