<br><font size=2 face="sans-serif">That example was signed after encryption
and then attempted to verify immediately after signing (though I have the
functionality to reverse those steps).</font>
<br><font size=2 face="sans-serif">I haven't used the command line utility
for xmlsec, at all. Is there a way to dump the content before digest
with the API?</font>
<br>
<br><font size=2 face="sans-serif">Thanks,</font>
<br><font size=2 face="sans-serif">Brian</font>
<br><font size=2 face="sans-serif">***************************************************************<br>
Brian S. Myers<br>
Systems Developer, Engineering<br>
brian.myers@zootweb.com<br>
Tel: 406-556-8924 Fax: 406-587-8414<br>
***************************************************************<br>
This email, including any attachments, is confidential and may not be redistributed
without permission. If you are not an intended recipient, you have received
this message in error. Please notify us immediately by replying to this
message, and then delete it from your computer. Thank you.<br>
***************************************************************</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Aleksey Sanin <aleksey@aleksey.com></b>
</font>
<br><font size=1 face="sans-serif">Sent by: xmlsec-bounces@aleksey.com</font>
<p><font size=1 face="sans-serif">07/03/2008 03:49 PM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">Brian.Myers@zootweb.com</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">xmlsec@aleksey.com</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Re: [xmlsec] verifying with xml-exc-c14n</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><tt><font size=2>Are you signing before or after encryption? Are you
verifying<br>
before or after encryption? Have you tried to use "--store-references"<br>
option to dump the content before doing digest?<br>
<br>
Aleksey<br>
<br>
Brian.Myers@zootweb.com wrote:<br>
> <br>
> Well, it can't be the http headers. I now think the problem
might be <br>
> with canonicalization.<br>
> <br>
> I can verify when I sign with the transform:<br>
> <dsig:Transform <br>
> Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><br>
> I can verify when I sign with the transform:<br>
> <dsig:Transform <br>
> Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/><br>
> <br>
> but when I sign with the transform:<br>
> <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><br>
> it fails to verify.<br>
> <br>
> And none of it verifies when I send to my server (which is some black
<br>
> box Microsoft implementation).<br>
> <br>
> It looks like the server is expecting Exclusive Canonicalization,
but I <br>
> can't even get that to work in my test environment.<br>
> <br>
> Attached is my xml document after signing (shortened the digest values,
<br>
> but otherwise unchanged).<br>
> Please take a look at it and see if I am doing something stupid.<br>
> <br>
> Thanks in advance,<br>
> Brian<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> *Aleksey Sanin <aleksey@aleksey.com>*<br>
> Sent by: xmlsec-bounces@aleksey.com<br>
> <br>
> 06/29/2008 08:19 PM<br>
> <br>
> <br>
> To<br>
> Brian.Myers@zootweb.com<br>
> cc<br>
> xmlsec@aleksey.com<br>
> Subject<br>
> Re:
[xmlsec] Signing a document that will be altered<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> <br>
> I highly doubt that http headers are involved in the signatures...<br>
> At least, not with xmlsec.<br>
> <br>
> Aleksey<br>
> <br>
> Brian.Myers@zootweb.com wrote:<br>
> ><br>
> > Hello,<br>
> > I think I'm running into a problem where the digital signature
is being<br>
> > made invalid due to an http post.<br>
> > Before I send my message to serverB I encrypt it and sign
it, I then<br>
> > post the message to the server.<br>
> > The post obviously adds http headers to the beginning of
the message,<br>
> > such as ContentType, ContentLength, ect.<br>
> > I'm guessing that even though these headers are not inside
the xml<br>
> > document, they are still affecting my digest.<br>
> ><br>
> > Is there a way to force the sign method to only sign the
xml as opposed<br>
> > to the whole string? and also force<br>
> > the severB verifier to verify the xml?<br>
> ><br>
> > Thank you,<br>
> > Brian<br>
> ><br>
> ><br>
> > ------------------------------------------------------------------------<br>
> ><br>
> > _______________________________________________<br>
> > xmlsec mailing list<br>
> > xmlsec@aleksey.com<br>
> > http://www.aleksey.com/mailman/listinfo/xmlsec<br>
> _______________________________________________<br>
> xmlsec mailing list<br>
> xmlsec@aleksey.com<br>
> http://www.aleksey.com/mailman/listinfo/xmlsec<br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> <br>
> _______________________________________________<br>
> xmlsec mailing list<br>
> xmlsec@aleksey.com<br>
> http://www.aleksey.com/mailman/listinfo/xmlsec<br>
_______________________________________________<br>
xmlsec mailing list<br>
xmlsec@aleksey.com<br>
http://www.aleksey.com/mailman/listinfo/xmlsec<br>
</font></tt>
<br>