(PowerShell) Verify an XML Signature with Multiple References

Demonstrates how to verify an XML digital signature that contains multiple references.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# An example of an enveloping XML signature with mulitple references is available at
# https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml

# This example will show how to verify the signature and all references, and also how
# to verify each reference individually.  This is useful to distinguish which part
# of the XML signature validation failed.  It could be that one or more of the references
# failed because of a hash computation mismatch.  Or it could be that the signature over
# the SignedInfo failed.  

# First, let's grab the sample XML signature.
$http = New-Object Chilkat.Http
$sbXml = New-Object Chilkat.StringBuilder
$success = $http.QuickGetSb("https://www.chilkatsoft.com/exampleData/envelopedMultipleRefs.xml",$sbXml)
if ($success -ne $true) {
    $($http.LastErrorText)
    exit
}

# Load the XML containing the signature to be verified.
$verifier = New-Object Chilkat.XmlDSig
$success = $verifier.LoadSignatureSb($sbXml)
if ($success -ne $true) {
    $($verifier.LastErrorText)
    exit
}

$verifyReferenceDigests = $true

# The quick way to validate all references and the signature over the SignedInfo
# is to call VerifySignature with verifyReferenceDigests equal to $true.
$verified = $verifier.VerifySignature($verifyReferenceDigests)
$("Signature and all reference digests verified = " + $verified)

# Let's pretend the call to VerifySignature returned $false.  Something did not validate.
# Was it one or more of the References that did not hash to the correct value?
# Or was it the signature over the SignedInfo that failed?
# We can check just the signature over the SignedInfo by passing $false to VerifySignature.
# This allows us to skip the hashing and checking each Reference.  
$verifyReferenceDigests = $false
$signedInfoVerified = $verifier.VerifySignature($verifyReferenceDigests)
$("Neglecting the reference hashes, the SignedInfo validation result = " + $signedInfoVerified)

# We can also verify each reference digest separately
$numRefs = $verifier.NumReferences
$i = 0
while ($i -lt $numRefs) {
    $refDigestVerified = $verifier.VerifyReferenceDigest($i)
    $("Reference " + $i + " digest verified = " + $refDigestVerified)
    $i = $i + 1
}

# For this sample XML signature with 3 References, we get the following output:

# Signature and all reference digests verified = True
# Neglecting the reference hashes, the SignedInfo validation result = True
# Reference 0 digest verified = True
# Reference 1 digest verified = True
# Reference 2 digest verified = Tru