(SQL Server) Create XML Digital Signature having KeyName

Demonstrates how to create an XML digital signature where the KeyInfo part will contain the KeyName element.
In this case, the public key is not specifically stored in the signed XML.
Rather, application specific information about the key is stored in the KeyName element.
The verifying application would use the KeyName to find and use the matching public key.

This example requires Chilkat v9.5.0.69 or greater.

Chilkat ActiveX Downloads

ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    -- The XML to be signed in this example contains the following:

    -- <?xml version="1.0" encoding="UTF-8" standalone="no"?>
    -- <Envelope>
    --   <Header>
    --     <Security>
    --     </Security>
    --   </Header>
    --   <Body Id="abc">
    --     <z:FooBar xmlns:z="https://www.example-code.com"/>
    --   </Body>
    -- </Envelope>

    -- The above XML is available at https://www.chilkatsoft.com/exampleData/xmlToSign.xml
    -- Fetch the XML and then sign it..

    DECLARE @url nvarchar(4000)
    SELECT @url = 'https://www.chilkatsoft.com/exampleData/xmlToSign.xml'
    DECLARE @http int
    -- Use "Chilkat_9_5_0.Http" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @sbXml int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbXml OUT

    DECLARE @success int
    EXEC sp_OAMethod @http, 'QuickGetSb', @success OUT, @url, @sbXml
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbXml
        RETURN
      END

    -- This example uses a DSA private key for signing.  
    -- There are many ways of getting an DSA private key using Chilkat.  This example
    -- will load it from an encrypted PEM file.

    -- In case you would like to use it, I put the DSA private key PEM file here:
    -- https://www.chilkatsoft.com/exampleData/dsa1024_secret.zip
    -- The password is "secret".
    DECLARE @dsaKey int
    -- Use "Chilkat_9_5_0.PrivateKey" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.PrivateKey', @dsaKey OUT

    EXEC sp_OAMethod @dsaKey, 'LoadEncryptedPemFile', @success OUT, 'qa_data/dsa/dsa1024_secret.pem', 'secret'
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @dsaKey, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbXml
        EXEC @hr = sp_OADestroy @dsaKey
        RETURN
      END

    DECLARE @xmlSigGen int
    -- Use "Chilkat_9_5_0.XmlDSigGen" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.XmlDSigGen', @xmlSigGen OUT

    -- Indicate where the XML Signature is to be inserted.
    EXEC sp_OASetProperty @xmlSigGen, 'SigLocation', 'Envelope|Header|Security'

    -- Specify the fragment of the XML document to be signed.
    -- This example will sign the fragment from <Body Id="abc"> ... </Body>
    EXEC sp_OAMethod @xmlSigGen, 'AddSameDocRef', @success OUT, 'abc', 'sha256', 'EXCL_C14N', '', ''

    -- Provide the DSA key to be used for signing:
    EXEC sp_OAMethod @xmlSigGen, 'SetPrivateKey', @success OUT, @dsaKey

    -- Specify what we want to emit in the KeyInfo part of the Signature.
    -- By default, it is the KeyValue that is emitted to the KeyInfo.
    -- In this example,we want to emit a key name rather than the actual public key value.
    EXEC sp_OASetProperty @xmlSigGen, 'KeyInfoType', 'KeyName'

    -- Provide a key name.  The verifying application will use the key name
    -- to find/load the public key to be used for verifying the signature.
    -- The key name is an arbitrary pre-agreed upon name that signer and verifier both know in advance.
    EXEC sp_OASetProperty @xmlSigGen, 'KeyInfoKeyName', 'dsaKey_123'

    -- The KeyInfo part of the XML signature to be created will contain this:
    -- 
    --     <ds:KeyInfo><ds:KeyName>dsaKey_123</ds:KeyName></ds:KeyInfo>
    -- 

    -- OK, everything's specified, so let's create the XML digital signature:
    -- This in-place signs the XML.  If successful, sbXml will contain the 
    -- XML with the digital signature at the specified location.
    EXEC sp_OASetProperty @xmlSigGen, 'Behaviors', 'IndentedSignature'
    EXEC sp_OAMethod @xmlSigGen, 'CreateXmlDSigSb', @success OUT, @sbXml
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @xmlSigGen, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbXml
        EXEC @hr = sp_OADestroy @dsaKey
        EXEC @hr = sp_OADestroy @xmlSigGen
        RETURN
      END

    -- Examine the signed XML:
    EXEC sp_OAMethod @sbXml, 'GetAsString', @sTmp0 OUT
    PRINT @sTmp0

    EXEC sp_OAMethod @sbXml, 'WriteFile', @success OUT, 'c:/chilkatsoft.com/exampleData/signedUsingKeyName.xml', 'utf-8', 0

    -- Below is the signed XML that is produced.
    -- 
    -- <?xml version="1.0" encoding="UTF-8" standalone="no"?>
    -- <Envelope>
    --   <Header>
    --     <Security>
    --     <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    --   <ds:SignedInfo>
    --     <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    --     <ds:SignatureMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
    --     <ds:Reference URI="#abc">
    --       <ds:Transforms>
    --         <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    --       </ds:Transforms>
    --       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    --       <ds:DigestValue>XTjDIHSEsDNTO9yn4cKtyXjRUjPFXkOQOLYI5mueZhk=</ds:DigestValue>
    --     </ds:Reference>
    --   </ds:SignedInfo>
    --   <ds:SignatureValue>F+HopRvLoj+9SHZxI/cGfX9SDfh+HRGZLMievGX3y/cckX1UzFuXCA==</ds:SignatureValue>
    --   <ds:KeyInfo>
    --     <ds:KeyName>dsaKey_123</ds:KeyName>
    --   </ds:KeyInfo>
    -- </ds:Signature></Security>
    --   </Header>
    --   <Body Id="abc">
    --     <z:FooBar xmlns:z="https://www.example-code.com"/>
    --   </Body>
    -- </Envelope>
    -- 

    EXEC @hr = sp_OADestroy @http
    EXEC @hr = sp_OADestroy @sbXml
    EXEC @hr = sp_OADestroy @dsaKey
    EXEC @hr = sp_OADestroy @xmlSigGen


END
GO