英文:
golang/goxmldig - Signature Verification Failed
问题
我尝试对实体描述符文件进行签名，但签名始终不正确。xmlsectool指出预期摘要与实际摘要不同。
以下是我根据README示例在goxmldsig上创建的代码。完整示例在pastebin上（stackoverflow不允许我在这里发布）。
xmlBytes := []byte(`<></>`)
keyPair, err := tls.X509KeyPair(certBytes, keyBytes)
failOnError(err, "无法加载密钥对")
keyStore := dsig.TLSCertKeyStore(keyPair)
signingContext := dsig.NewDefaultSigningContext(keyStore)
signingContext.Canonicalizer = dsig.MakeC14N10ExclusiveCanonicalizerWithPrefixList("")
err = signingContext.SetSignatureMethod(dsig.RSASHA256SignatureMethod)
failOnError(err, "设置签名方法失败")
readXMLDoc := etree.NewDocument()
err = readXMLDoc.ReadFromBytes(xmlBytes)
failOnError(err, "无法解析XML")
elementToSign := readXMLDoc.Root()
elementToSign.CreateAttr("ID", "id1234")
signedElement, err := signingContext.SignEnveloped(elementToSign)
failOnError(err, "无法签名")
var signedAssertionBuf []byte
{
readXMLDoc.SetRoot(signedElement)
signedAssertionBuf, err = readXMLDoc.WriteToBytes()
failOnError(err, "无法将文档转换为字节")
}
ioutil.WriteFile("/tmp/test/example.xml", signedAssertionBuf, 0775)
你可以在goxmldsig的README中找到更多信息，完整示例在pastebin上。
英文:
I have attempted to sign a entities descriptor file, but the signature is always incorrect. xmlsectool states that the signature is expected digest is not the same as the actual digest.
xmlsectool-2.0.0/xmlsectool.sh --verifySignature --certificate saml.crt --inFile example.xml
INFO XMLSecTool - Reading XML document from file 'example.xml'
INFO XMLSecTool - XML document parsed and is well-formed.
WARN Reference - Verification failed for URI "#id1234"
WARN Reference - Expected Digest: D+SEh34cA7/atdQ8ojV9rzUcJcJSAslFZ0aOIwplGfI=
WARN Reference - Actual Digest: EYun0wngsN35ci20wRziCXs0Io7J4bZN+NYRnnTR5QM=
ERROR XMLSecTool - XML document signature verification failed
I followed the README example on goxmldsig to create the following code. The full example is on pastebin(stackoverflow wouldn't let me post it here).
xmlBytes := []byte(`<></>`)
keyPair, err := tls.X509KeyPair(certBytes, keyBytes)
failOnError(err, "invalided to load keypair")
keyStore := dsig.TLSCertKeyStore(keyPair)
signingContext := dsig.NewDefaultSigningContext(keyStore)
signingContext.Canonicalizer = dsig.MakeC14N10ExclusiveCanonicalizerWithPrefixList("")
err = signingContext.SetSignatureMethod(dsig.RSASHA256SignatureMethod)
failOnError(err, "failed to set signature method")
readXMLDoc := etree.NewDocument()
err = readXMLDoc.ReadFromBytes(xmlBytes)
failOnError(err, "cannot parse xml")
elementToSign := readXMLDoc.Root()
elementToSign.CreateAttr("ID", "id1234")
signedElement, err := signingContext.SignEnveloped(elementToSign)
failOnError(err, "failed to sign envelop")
var signedAssertionBuf []byte
{
readXMLDoc.SetRoot(signedElement)
signedAssertionBuf, err = readXMLDoc.WriteToBytes()
failOnError(err, "failed to convert doc to bytes")
}
ioutil.WriteFile("/tmp/test/example.xml", signedAssertionBuf, 0775)
答案1
得分: 2
似乎问题与在某些元素中包含以下属性有关：
xml:lang="en"
例如：
<OrganizationName xml:lang="en">Your Identities</OrganizationName>
如果您删除所有元素中的 xml:lang="en"，生成的签名将变为有效并正确验证。
据我所见，当您包含该属性时，实际 XML 文档中的元素似乎变成了这样：
<OrganizationName xmlns:xml="http://www.w3.org/XML/1998/namespace" xml:lang="en">Your Identities</OrganizationName>
这使得签名无效。
英文:
It seems the problem is related to including this attribute in some of your elements:
xml:lang="en"
For example in:
<OrganizationName xml:lang="en">Your Identities</OrganizationName>
If you remove the xml:lang="en" for all elements, the generated signature turns to be valid and correctly verified.
As far as I can see, when you include that attribute, the elements written on the actual XML document seem to turn into this:
<OrganizationName xmlns:xml="http://www.w3.org/XML/1998/namespace" xml:lang="en">Your Identities</OrganizationName>
And that makes the signature invalid.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论