(Tcl) ZATCA QR Code TLV Encoding and ECDSA Cryptographic Stamp

See more ZATCA Examples

Demonstrates how to create the TLV encoding of the QR code fields, then apply the ECDSA signature and ECDSA public key, and finally insert into the previously signed XML E-Invoice.

Note: This example requires Chilkat v9.5.0.92 or greater.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# In Step 1, we applied a signature to an e-invoice Zakat, Tax and Customs Authority (ZATCA) of Saudi Arabia

# This example is Step 2, where we compose the TLV encoding of the QR code, apply the ECDSA signature, and then insert into the signed XML without disturbing the signed XML.

# Construct TLV (Tag-Length-Value) encoding of the QR data.
# We have 5 pieces of data: Seller Name, VAT Number, Time Stamp, Invoice Total, and VAT Total.
# For example:
set sellerName "Firoz Ashraf"
set vatNumber "1234567891"

# The timestamp in QR Code should be based on Invoice Issue Time (KSA-25) and Invoice Issue Date (BT-2). 
# It can either be in format YYYY-MM-DD'T'HH:MM:SS (for local time in KSA) or YYYY-MM-DD'T'HH:MM:SS'Z' (for UTC time or Zulu time)

# Get the current UTC date/time in this format: YYYY-MM-DD'T'HH:MM:SS'Z'
set dt [new_CkDateTime]

CkDateTime_SetFromCurrentSystemTime $dt
set timeStamp [CkDateTime_getAsTimestamp $dt 0]
set invoiceTotal "100.00"
set vatTotal "15.00"

# TLV encode into a Chilkat BinData object.
set bdTlv [new_CkBinData]

set charset "utf-8"

set tag 1
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendCountedString $bdTlv 1 0 $sellerName $charset
set tag [expr $tag + 1]
# This is tag 2
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendCountedString $bdTlv 1 0 $vatNumber $charset
set tag [expr $tag + 1]
# This is tag 3
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendCountedString $bdTlv 1 0 $timeStamp $charset
set tag [expr $tag + 1]
# This is tag 4
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendCountedString $bdTlv 1 0 $invoiceTotal $charset
set tag [expr $tag + 1]
# This is tag 5
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendCountedString $bdTlv 1 0 $vatTotal $charset

# ----------------------------------------------------------------------------------------------------------------------------------------------
# For tag 6, we need the SHA256 hash from the signed XML.  This is the DigestValue as shown in the fragment of the XML Signature below:

#     <ds:Reference Id="invoiceSignedData" URI="">
#         <ds:Transforms>
#             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
#                 <ds:XPath>not(//ancestor-or-self::ext:UBLExtensions)</ds:XPath>
#             </ds:Transform>
#             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
#                 <ds:XPath>not(//ancestor-or-self::cac:Signature)</ds:XPath>
#             </ds:Transform>
#             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
#                 <ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
#             </ds:Transform>
#             <ds:Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
#         </ds:Transforms>
#         <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
#         <ds:DigestValue>zCp+kF1qzNgXD6AhLq69/CYCklMFSXUmmVPbm4v/76U=</ds:DigestValue>
#     </ds:Reference>

# To get this information, we'll need to load the signed XML into a Chilkat XML object, and then access it.
# Load the XML we previously signed...
set signedXmlFilePath "qa_data/zatca/testing/SignedXML.xml"
set xmlSigned [new_CkXml]

set success [CkXml_LoadXmlFile $xmlSigned $signedXmlFilePath]
if {$success == 0} then {
    puts [CkXml_lastErrorText $xmlSigned]
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    exit
}

# digestValue is a base64 string.
set sbDigestValue [new_CkStringBuilder]

set success [CkXml_GetChildContentSb $xmlSigned "ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:SignedInfo|ds:Reference[0]|ds:DigestValue" $sbDigestValue]
if {$success == 0} then {
    puts "Failed to get DigestValue from signed XML."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    exit
}

puts "DigestValue = [CkStringBuilder_getAsString $sbDigestValue]"

# Append the DigestValue base64 string to the TLV.
set tag 6
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendByte $bdTlv [CkStringBuilder_get_Length $sbDigestValue]
CkBinData_AppendSb $bdTlv $sbDigestValue "utf-8"

# ----------------------------------------------------------------------------------------------------------------------------------------------
# Tag 7 will contain the <ds:Signature> value from the signed XML.
# PS> To get the XML path passed to GetChildContentSb, you can copy/paste the signed XML into Chilkat's online tool at https://tools.chilkat.io/xmlParse
# The parsing code that is generated by the online tool will reveal the required path to the element in the XML.
set sbSignatureValue [new_CkStringBuilder]

set success [CkXml_GetChildContentSb $xmlSigned "ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:SignatureValue" $sbSignatureValue]
if {$success == 0} then {
    puts "Failed to get SignatureValue from signed XML."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    exit
}

puts "SignatureValue = [CkStringBuilder_getAsString $sbSignatureValue]"

# Append the SignatureValue base64 string to the TLV.
set tag 7
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendByte $bdTlv [CkStringBuilder_get_Length $sbSignatureValue]
CkBinData_AppendSb $bdTlv $sbSignatureValue "utf-8"

# ----------------------------------------------------------------------------------------------------------------------------------------------
# Tag 8 will contain the public key of the signing certificate.
# The signing certificate is available within the signed XML at <ds:X509Certificate>.
set x509Certificate [CkXml_getChildContent $xmlSigned "ext:UBLExtensions|ext:UBLExtension|ext:ExtensionContent|sig:UBLDocumentSignatures|sac:SignatureInformation|ds:Signature|ds:KeyInfo|ds:X509Data|ds:X509Certificate"]
if {[CkXml_get_LastMethodSuccess $xmlSigned] == 0} then {
    puts "Failed to get X509Certificate from the signed XML."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    exit
}

set cert [new_CkCert]

set success [CkCert_SetFromEncoded $cert $x509Certificate]
if {$success == 0} then {
    puts "Failed to load signing certificate from base64."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    delete_CkCert $cert
    exit
}

# We want to get the cert's public key bytes having this ASN.1 format.
# SEQUENCE (2 elem)
#   SEQUENCE (2 elem)
#     OBJECT IDENTIFIER 1.2.840.10045.2.1 ecPublicKey (ANSI X9.62 public key type)
#     OBJECT IDENTIFIER 1.3.132.0.10 secp256k1 (SECG (Certicom) named elliptic curve)
#   BIT STRING (520 bit) 0000010001110000110111000001111110100110101110110101111000110001110100

# Note: The cert.GetPubKeyDer method was added in Chilkat v9.5.0.92
set bdPubKey [new_CkBinData]

set success [CkCert_GetPubKeyDer $cert 1 $bdPubKey]
if {$success == 0} then {
    puts "Failed to get certificate's public key."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    delete_CkCert $cert
    delete_CkBinData $bdPubKey
    exit
}

# We want to add the binary bytes of the public key (not the base64 string) to the QR code.
set tag 8
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendByte $bdTlv [CkBinData_get_NumBytes $bdPubKey]
CkBinData_AppendBd $bdTlv $bdPubKey

# Show the public key in base64 format:
puts "Certificate public key:"
puts [CkBinData_getEncoded $bdPubKey base64]

# ----------------------------------------------------------------------------------------------------------------------------------------------
# Tag 9 will contain the signature contained in the signing certificate.

# Note: The cert.GetPubKeyDer method was added in Chilkat v9.5.0.92
set bdCertSig [new_CkBinData]

set success [CkCert_GetSignature $cert $bdCertSig]
if {$success == 0} then {
    puts "Failed to get certificate's signature."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    delete_CkCert $cert
    delete_CkBinData $bdPubKey
    delete_CkBinData $bdCertSig
    exit
}

# We want to add the binary bytes of the signature (not the base64 string) to the QR code.
set tag 9
CkBinData_AppendByte $bdTlv $tag
CkBinData_AppendByte $bdTlv [CkBinData_get_NumBytes $bdCertSig]
CkBinData_AppendBd $bdTlv $bdCertSig

# Show the cert's signature in hex format:
puts "Certificate signature:"
puts [CkBinData_getEncoded $bdCertSig hex]

# ----------------------------------------------------------------------------------------------------------------------------------------------
# At this point the full QR code is contained in bdTlv.
# Get it as a base64 string
set qr_base64 [CkBinData_getEncoded $bdTlv "base64"]
puts "QR: $qr_base64"

# ----------------------------------------------------------------------------------------------------------------------------------------------
# Insert the QR XML fragment into the previously signed XML -- without disturbing (invalidating) the signature.

# We need to build and insert the following XML fragment under the 
# as a cac:AdditionalDocumentReference just before the "<cac:Signature>" opening tag.

#    <cac:AdditionalDocumentReference>
#         <cbc:ID>QR</cbc:ID>
#         <cac:Attachment>
#             <cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">BASE64_TLV_CONTENT</cbc:EmbeddedDocumentBinaryObject>
#         </cac:Attachment>
#    </cac:AdditionalDocumentReference>

set xmlQR [new_CkXml]

CkXml_put_Tag $xmlQR "cac:AdditionalDocumentReference"
CkXml_UpdateChildContent $xmlQR "cbc:ID" "QR"
CkXml_UpdateAttrAt $xmlQR "cac:Attachment|cbc:EmbeddedDocumentBinaryObject" 1 "mimeCode" "text/plain"
CkXml_UpdateChildContent $xmlQR "cac:Attachment|cbc:EmbeddedDocumentBinaryObject" [CkBinData_getEncoded $bdTlv "base64"]

# Load our previously signed XML into a Chilkat StringBuilder.
# We should not load the previously signed XML into a Chilkat XML object because the XML gets loaded into an internal DOM (Document Object Model).
# When re-emitted from the DOM, formatting can change and it would break the XML signature.
# Therefore, we must load into a StringBuilder and insert the new fragment without disturbing the remainder.
# The inserted fragment is ignored because the following transform was included in the XML signature reference:

#             <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
#                 <ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
#             </ds:Transform>

set sbSignedXml [new_CkStringBuilder]

set success [CkStringBuilder_LoadFile $sbSignedXml $signedXmlFilePath "utf-8"]
if {$success == 0} then {
    puts "Failed to load previously signed XML file."
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    delete_CkCert $cert
    delete_CkBinData $bdPubKey
    delete_CkBinData $bdCertSig
    delete_CkXml $xmlQR
    delete_CkStringBuilder $sbSignedXml
    exit
}

set sbReplaceStr [new_CkStringBuilder]

CkXml_put_EmitXmlDecl $xmlQR 0
CkXml_put_EmitCompact $xmlQR 1
CkStringBuilder_Append $sbReplaceStr [CkXml_getXml $xmlQR]
CkStringBuilder_Append $sbReplaceStr "<cac:Signature>"
set success [CkStringBuilder_ReplaceFirst $sbSignedXml "<cac:Signature>" [CkStringBuilder_getAsString $sbReplaceStr]]
if {$success == 0} then {
    puts "Did not find <cac:Signature> in the signed XML"
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    delete_CkCert $cert
    delete_CkBinData $bdPubKey
    delete_CkBinData $bdCertSig
    delete_CkXml $xmlQR
    delete_CkStringBuilder $sbSignedXml
    delete_CkStringBuilder $sbReplaceStr
    exit
}

# Save the updated signed XML.
set success [CkStringBuilder_WriteFile $sbSignedXml "qa_output/signedXML_withQR.xml" "utf-8" 0]

# ----------------------------------------
# Verify the updated signed XML to make sure we didn't invalidate the signature...
set verifier [new_CkXmlDSig]

set success [CkXmlDSig_LoadSignatureSb $verifier $sbSignedXml]
if {$success != 1} then {
    puts [CkXmlDSig_lastErrorText $verifier]
    delete_CkDateTime $dt
    delete_CkBinData $bdTlv
    delete_CkXml $xmlSigned
    delete_CkStringBuilder $sbDigestValue
    delete_CkStringBuilder $sbSignatureValue
    delete_CkCert $cert
    delete_CkBinData $bdPubKey
    delete_CkBinData $bdCertSig
    delete_CkXml $xmlQR
    delete_CkStringBuilder $sbSignedXml
    delete_CkStringBuilder $sbReplaceStr
    delete_CkXmlDSig $verifier
    exit
}

# ---------------- This is important -----------------------------------------
# Starting in Chilkat v9.5.0.92, specify "ZATCA" in uncommon options 
# to validate signed XML according to ZATCA needs.
# ----------------------------------------------------------------------------
CkXmlDSig_put_UncommonOptions $verifier "ZATCA"

set numSigs [CkXmlDSig_get_NumSignatures $verifier]
set verifyIdx 0
while {$verifyIdx < $numSigs} {
    CkXmlDSig_put_Selector $verifier $verifyIdx
    set verified [CkXmlDSig_VerifySignature $verifier 1]
    if {$verified != 1} then {
        puts [CkXmlDSig_lastErrorText $verifier]
        delete_CkDateTime $dt
        delete_CkBinData $bdTlv
        delete_CkXml $xmlSigned
        delete_CkStringBuilder $sbDigestValue
        delete_CkStringBuilder $sbSignatureValue
        delete_CkCert $cert
        delete_CkBinData $bdPubKey
        delete_CkBinData $bdCertSig
        delete_CkXml $xmlQR
        delete_CkStringBuilder $sbSignedXml
        delete_CkStringBuilder $sbReplaceStr
        delete_CkXmlDSig $verifier
        exit
    }

    set verifyIdx [expr $verifyIdx + 1]
}
puts "All signatures were successfully verified."

delete_CkDateTime $dt
delete_CkBinData $bdTlv
delete_CkXml $xmlSigned
delete_CkStringBuilder $sbDigestValue
delete_CkStringBuilder $sbSignatureValue
delete_CkCert $cert
delete_CkBinData $bdPubKey
delete_CkBinData $bdCertSig
delete_CkXml $xmlQR
delete_CkStringBuilder $sbSignedXml
delete_CkStringBuilder $sbReplaceStr
delete_CkXmlDSig $verifier