<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body>
Please take a look at tests/testDSig.sh script. There are a lot of different
examples of xmlsec<br>
and XML DSig usage. Also you might find some information by running 'xmlsec
help-verify' <br>
and 'xmlsec help-sign' :)<br>
<br>
Regarding your question about using certs: --pubkey expects a public key
in PEM format.<br>
Of course, using PEM cert with this option fails. And I am not sure I understand
why you <br>
need certs in your case. I see 2 different possible cases here:<br>
1) The signature was done using a private key and Alice embeds cert(s)
(or pointer to cert)<br>
in the signature. XML DSig and xmlsec allows you to do this but this
means that you need <br>
to specify cert(s) on signature stage. Check <dsig:X509Data />
element description in XML <br>
DSig spec for details. Note, that certs are used to establish trust "inside"
XML DSig process.<br>
2) The signature was done using a private key and Alice sends public
key to Bob using <br>
some other trusted way (outside XMLDSig). In this case, the input for
XMLDSig (and xmlsec)<br>
is just a public key. We do not care how we get it and how the trust
was established.<br>
<br>
I guess, right now you are trying to do 2) and use cert just as a public
key. However, from <br>
XMLSec point of view, this is "illegal". OpenSSL (and any other crypto toolkit)
provides<br>
easy ways to get public key from the cert. Just pass it to the xmlsec utility
and everything <br>
should work :) And of course, you can write your own code to extract key
and load in xmlsec <br>
library keys manager. But I don't see a need for this in the xmlsec utility.<br>
<br>
<br>
Aleksey<br>
<br>
Wayne Cheng wrote:<br>
<blockquote type="cite"
cite="mid20021223051451.58661.qmail@web20417.mail.yahoo.com">
<pre wrap="">Hi Aleksey,
Thanks for your help, I modify xml.txt for the right signature
algorithm. Now, the following signing works.
xmlsec sign --privkey:signed ./signing.key xml.txt >xml.signed
I wonder if it is possible to use the certificate to verify
the signed document. So far, I can use the folllowing format
to verify the signed document.
xmlsec verify --print-signature .cert xml.signed
If I use the format:
xmlsec verify --pubkey:signed ./signing.cert xml.signed
or
xmlsec verify --print-signature --pubkey:signed ./signing.cert xml.signed
It will complain about the wrong format.
Thanks,
Wayne
--- Aleksey Sanin <a class="moz-txt-link-rfc2396E" href="mailto:aleksey@aleksey.com"><aleksey@aleksey.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Forgot to say that algorithm and all other signature parameters used by
xmlsec
utility are in the templates file. Please read XML Digital Signature
spec for details.
Aleksey
Aleksey Sanin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I am not sure I clear understand what does the "generation algorithm
RSA-SHA1" mean
but assuming that server.key has a private RSA key then you should
check that xml.txt
template uses RSA-SHA1 signature algorithm. This is the only reasons I
can think of for
the error you have.
BTW, I think it'll be very helpful if you send related files next time :)
Aleksey
Wayne Cheng wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Thank you so much for your quick response.
The server.key generation algorithm we used is RSA-sha1. I am not
sure where to
find/change
algorithm used for signature for xmlsec utility.
I tried the new format and it still not working. Also, I am not sure
if rename
for server is required or not.
bash-2.05$ xmlsec sign --privkey:server ./server.key xml.txt
xmlSecKeysMngrGetKey (keys.c:451): error 17: key not found :
xmlSecSignedInfoRead (xmldsig.c:1385): error 17: key not found :
xmlSecSignatureRead (xmldsig.c:1124): error 2: xmlsec operation failed :
xmlSecS
ignedInfoRead - -1
xmlSecDSigGenerate (xmldsig.c:792): error 2: xmlsec operation failed :
xmlSecSig
natureRead - -1
Error: xmlSecDSigGenerate() failed
Error: operation failed
bash-2.05$
Thanks,
Wayne
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
<a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a>
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
<a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a>
</pre>
</blockquote>
<pre wrap=""><!---->
__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
<a class="moz-txt-link-freetext" href="http://mailplus.yahoo.com">http://mailplus.yahoo.com</a>
_______________________________________________
xmlsec mailing list
<a class="moz-txt-link-abbreviated" href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>
<a class="moz-txt-link-freetext" href="http://www.aleksey.com/mailman/listinfo/xmlsec">http://www.aleksey.com/mailman/listinfo/xmlsec</a>
</pre>
</blockquote>
<br>
</body>
</html>