Transcript SI-3-slides - the GMU ECE Department

Implementation Of
XML DIGITAL SIGNATURES
Using Microsoft .NET
PRESENTED BY :
NANIDITA SRIVASTAVA
NEEHARIKA KOLLA
MOUNIKA VALLABHANENI
MAIN FOCUS OF THE PROJECT:
1.Feature of XML digital signatures
2.XML documents and XML digital signatures in
brief.
3.Creation of windows based application using .NET
& C#
4.Application lets user encode and sign specific parts
of an XML file.
5.Presenting 3 test cases where user changes the or
the key…….and verification produces invalid results
Digital Signatures
A digital signature is an electronic signature that can be used to
authenticate the identity of the sender of a message or the signer
of a document.
XML Digital Signatures
•Digital signatures designed for use in XML transactions.
•Joint effort between the World Wide Web Consortium (W3C) and Internet Engineering
Task Force (IETF)
Similarities and Differences with Standard Digital Signatures
Similarities
Authentication
Data integrity
Support for non-repudiation
Differences
Support for Web based nature of todays transactions
What is XML
XML is a markup language for documents containing structured information. XML
was created so that richly structured documents could be used over the web. The
only viable alternatives, HTML as it comes bound with a set of semantics and does
not provide arbitrary structure.
A sample XML document
<?xml version="1.0" encoding="utf8"?>
<Companies>
<CompanyA>
<DocumentInformation>
<documentName namingSystem="POSC">Sample 3</documentName>
</ DocumentInformation >
<BusinessAssociate>
<AuthorizedPerson>
<name>Marvin P. Mooney</name>
<title>Vice President of Drilling Operations</title>
</AuthorizedPerson>
</BusinessAssociate>
<LegalDescription>
<townshipNumber direction="N">50</townshipNumber>
</LegalDescription>
</CompanyA>
</ Companies >
Why XML is important
(Use in Web Services)
Web services are application programming interfaces (API) that can be accessed over a
network, such as the Internet, and executed on a remote system.
Generic Web Service Architecture
Use of XML Digital Signatures in Web Services

Non-repudiation and integrity assume alarming dimensions in a web service-driven world.
Suppose that a confidential XML document is populated by services A and B, and is passed on to
service E by C and D. To make things worse, let's assume that these services are provided by
different systems/vendors across the Net! Now, how can the end consumer service E ensure the
authenticity of the sender services A and B? What guarantee does it have that the XML data
passed on from A and B has not been modified during the transit or by other malicious services?
With hacking becoming a common phenomenon on the Internet, it is quite possible that
unauthorized services will come to life all of a sudden from the network and start consuming
confidential business data. How can we make sure that the sender services A and B take full
responsibility for what is contained in the XML document?
Example
The Components of an XML Signature
XML Digital Signatures
An XML signature can sign more than one type of resource. For example, a single XML signature
might cover character-encoded data (HTML), binary-encoded data (a JPG), XML-encoded data, and a
specific section of an XML file.
Steps to create XML Digital Signatures
• Determine which resources are to be signed.
This will take the form of identifying the resources through a Uniform Resource Identifier (URI).
"http://www.abccompany.com/index.html" would reference an HTML page on the Web
"http://www.abccompany.com/logo.gif" would reference a GIF image on the Web
. Calculate the digest of each resource. Create
Reference element
DigestValue element
DigestMethod element
•Collect the Reference elements. Create
SignedInfo element
CanonicalizationMethod
SignatureMethod
Steps to create XML Digital Signatures
Signing
SignatureValue element.
Add key information
KeyInfo element
Enclose in a Signature element
Signature element
Steps to verify XML Digital Signatures
Recalculate the digest of the <SignedInfo> element (using the digest algorithm specified in the
<SignatureMethod> element) and use the public verification key to verify that the value of the
<SignatureValue> element is correct for the digest of the <SignedInfo> element.
If this step passes, recalculate the digests of the references contained within the <SignedInfo>
element and compare them to the digest values expressed in each <Reference> element's
corresponding <DigestValue> element.
Concepts central to XML Digital Signature Specifications
X-PATH Transforms
•
•
Specifies which content is to be signed.
Evaluates Expressions to filter out the nodes. Example child::*
In our project Refence.AddTransform(CreateXPathTransform("ancestor-or-self::CompanyA"))
Cannonicalization
•
•
Important to take care of formatting differences between two logically similar
documents.
The canonicalization algorithm used normally changes the character encding to
UTF-8,Change the line breaks to #Xa etc.
In our project SignedXml.XmlDsigCanonicalizationUrl field specifies this
Types of XML digital Signatures
Enveloped
Enveloping
Detached
.Net Implementation of XML Digital Signatures
The System.Security.Cryptography namespace in .NET provides cryptographic services, including secure
encoding and decoding of data, as well as many other operations, such as hashing, random number generation,
and message authentication. The hierarchy of the classes found in the framework are as follows
Algorithm type classes (Abstract)
•SymmetricAlgorithm or HashAlgorithm
•Abstract classes
Algorithm class (Abstract)
•Inherits from an algorithm type class
•RC2 or SHA1
•Abstract
Implementation of an algorithm class
•These inherits from an algorithm class
•RC2CryptoServiceProvider or SHA1 Managed
•Fully implemented
Crypto Service Providers used in our project
DESCryptoServiceProvider for Encryption-Implements Data Encryption Standard (DES) algorithm used
in CBC mode
RSACryptoServiceProvider for Signing -Implements RSA algorithm
Project Implementation
•
•
•
•
Windows based application (C# )
User selects an XML file
Application encodes and Signs the file
Application can decode and Verify the Signature
Key Creation
Use of sn.exe utility
Created key stored in an XML file
Decryption
Create a crypto key from an XML file
Code Snippet
XmlDocument xmldoc=new XmlDocument();
xmldoc.LoadXml(xml);
// Get the key pair from the key store.
CspParameters parms=new CspParameters(1);
parms.Flags=CspProviderFlags.UseMachineKeyStore;
parms.KeyContainerName=keyContainerName;
parms.KeyNumber=2;
// PROV_RSA_FULL
// Use Machine store
RSACryptoServiceProvider csp=new RSACryptoServiceProvider(parms);
// Creating the XML signing object.
SignedXml sxml=new SignedXml(xmldoc);
sxml.SigningKey=csp;
// Set the canonicalization method for the document.
sxml.SignedInfo.CanonicalizationMethod=SignedXml.XmlDsigCanonicalizationUrl; // No comments.
// Create an empty reference (not enveloped) for the XPath transformation.
Reference r=new Reference("");
r.AddTransform(CreateXPathTransform("ancestor-or-self::CompanyA"));
sxml.AddReference(r);
// Add the reference to the SignedXml object.
sxml.AddReference(r);
// Compute the signature.
sxml.ComputeSignature();
// Get the signature XML and add it to the document element.
XmlElement sig=sxml.GetXml();
xmldoc.DocumentElement.AppendChild(sig);
// Write-out formatted signed XML.
StringBuilder sb=new StringBuilder();
StringWriter tw=new StringWriter(sb);
XmlTextWriter writer=new XmlTextWriter(tw);
writer.Formatting=Formatting.Indented;
DEMO
Thanks