Digital signing XML message using Java

[John Paul Hoey]

We have an unsupported application at my place of work which digitally signs XML messages using a certificate from a keystore that we want to replace. Im attempting to write a replacement application using Java however when I sign the XML, the generated digital signatures between both the existing application and my Java code are different. As the existing application obviously works Im not sure what is wrong with my Java code.

The digital signatures generated between both the existing application and my Java code are exactly the same except from the digest value and the signature value.

Here is the digital signature that is generated:

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">            <SignedInfo>                <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>                <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                <Reference URI="">                    <Transforms>                        <Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>                    </Transforms>                    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>                    <DigestValue>Amj4gpGgVaLsiuaU0gceXYUazOI=</DigestValue>                </Reference>            </SignedInfo>            <SignatureValue>hwbSkMimeA0ib4OADR64L1bO75vPnt3d6ULZtmVOW0hCx3vtEM/IR80IdLgYf1FDOjKZi+no37hU9Rv0KOPPqvN5PK8mFdFSe4N9DTLsGym8/iCDnMoepRpKdoGwZjFFmi/iyBZDuZQD84O7JkeE76tc254gEM7bhX9okFLEL/A=</SignatureValue>            <KeyInfo>                <X509Data>                    <X509IssuerSerial>                        <X509IssuerName>DC=local, DC=PR-CA, CN=Organisation</X509IssuerName>                        <X509SerialNumber>290432545904520689811773</X509SerialNumber>                    </X509IssuerSerial>                </X509Data>            </KeyInfo>        </Signature>

Here is the code that I use to generate the digital signature:

XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");

Transform exc14nTranform = fac.newTransform("http://www.w3.org/TR/2001/REC-xml-c14n-20010315", (TransformParameterSpec) null);
Transform envTransform = fac.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null);

List<Transform> transformList = new ArrayList();
transformList.add(exc14nTranform);
transformList.add(envTransform);

Reference ref = fac.newReference("", fac.newDigestMethod(DigestMethod.SHA1, null), transformList,null, null);

SignedInfo si = fac.newSignedInfo(fac.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE,(C14NMethodParameterSpec) null),fac.newSignatureMethod(SignatureMethod.RSA_SHA1, null), Collections.singletonList(ref));

KeyStore ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream("C:\\keystore.jks"), "changeit".toCharArray());
KeyStore.PrivateKeyEntry keyEntry = (KeyStore.PrivateKeyEntry) ks.getEntry ("alias", new KeyStore.PasswordProtection("password".toCharArray()));     
X509Certificate cert = (X509Certificate) keyEntry.getCertificate();

KeyInfoFactory kif = fac.getKeyInfoFactory();
List x509Content = new ArrayList();

X509IssuerSerial issuer = kif.newX509IssuerSerial("DC=local, DC=PR-CA, CN=Organisation", cert.getSerialNumber());
x509Content.add(issuer);

X509Data xd = kif.newX509Data(x509Content);
KeyInfo ki = kif.newKeyInfo(Collections.singletonList(xd));

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
doc = dbf.newDocumentBuilder().parse(new FileInputStream("C:\\test.xml"));

DOMSignContext dsc = new DOMSignContext(keyEntry.getPrivateKey(), doc.getDocumentElement());
XMLSignature signature = fac.newXMLSignature(si, ki);
signature.sign(dsc);

OutputStream os = new FileOutputStream("C:\\outputXML.xml");
TransformerFactory tf = TransformerFactory.newInstance();
Transformer trans = tf.newTransformer();
trans.transform(new DOMSource(doc), new StreamResult(os));

Can someone more experienced than me please take a look over my code to ensure that it looks OK and im not missing anything obvious? Also, any other troubleshooting tips that can be offered would be greatly appreciated. Thanks

[John Paul Hoey]

Just a quick update to inform anyone who may be interested that I managed to get my code to work. There where two issues:

1) The reference transforms were being added to the arraylist in the incorrect order, the ordering has to be the other way around as follows:

transformList.add(envTransform);
transformList.add(exc14nTranform);

2) The white space between the elements of the XML that was being loaded by my code had to be removed. I did this using the following code:

public static ByteArrayInputStream TrimWhiteSpaceFromXml() 
    {
        
        ByteArrayInputStream xmlStream = null; 
        
        try 
        {
            
            String thisLine = "";
            String xmlString = "";
            BufferedReader br = new BufferedReader(new FileReader("C:\\MyFile.xml"));
            
            while ((thisLine = br.readLine()) != null)
            {
                xmlString = xmlString + thisLine.trim();
            }
            br.close();
            
            xmlStream = new ByteArrayInputStream(xmlString.getBytes());
            
            // Print out details of loaded XML file
            int n = xmlStream.available();
            byte[] bytes = new byte[n];
            xmlStream.read(bytes, 0, n);
            String s = new String(bytes, StandardCharsets.UTF_8);
            xmlStream.reset();
            System.out.println("Input XML: " + s);
               
        } 
        catch (IOException ex) 
        {
            ex.printStackTrace();
        }
        
            return xmlStream;
    }

Once I had performed the above, the digital signatures included within my XML worked as expected.

Just to add, I used the following code to also verify my digital signatures worked:

public class Validate 
{
    
    public static boolean verify() 
    {

        boolean verificationResult = false;

        try 
        {
            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
            dbf.setNamespaceAware(true);
            Document signedDocument = dbf.newDocumentBuilder().parse("C:\\MyFile.xml");

            NodeList nl = signedDocument.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
            
            if (nl.getLength() == 0) 
            {
                throw new IllegalArgumentException("Cannot find Signature element");
            }

            XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");

            DOMValidateContext valContext = new DOMValidateContext(GetPublicKey(), nl.item(0));
            XMLSignature signature = fac.unmarshalXMLSignature(valContext);

            verificationResult = signature.validate(valContext);           
            
        } 
        catch (Exception e) 
        {
            System.out.println("Error while verifying digital siganature" + e.getMessage());
            e.printStackTrace();
        }

            return verificationResult;
    }
   
    public static PublicKey GetPublicKey()
    {
        PublicKey publicKey = null;
        FileInputStream is = null;
        
        try 
        {
            is = new FileInputStream("C:\\MyJavaKeyStore.jks");
            KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
            keystore.load(is, "changeit".toCharArray());
            String alias = "Alias";
            Key key = keystore.getKey(alias, "password".toCharArray());
            if (key instanceof PrivateKey) 
            {

                // Get certificate of public key
                //java.security.Certificate cert = (java.security.Certificate) keystore.getCertificate(alias);
                X509Certificate cert = (X509Certificate) keystore.getCertificate(alias);

                // Get public key
                publicKey = cert.getPublicKey();
                
            }   
        } 
        catch (FileNotFoundException ex) 
        {
        } 
        catch (KeyStoreException | NoSuchAlgorithmException | CertificateException | UnrecoverableKeyException | IOException ex) 
        {
        } 
        finally 
        {
            try 
            {
                is.close();
            } 
            catch (IOException ex) 
            {
                ex.printStackTrace();
            }
        }
        
        
        return publicKey;

    }    
} 

Hopefully the above may help someone in the future.