2 // SignedXml.cs - SignedXml implementation for XML Signature
5 // Sebastien Pouliot <sebastien@ximian.com>
6 // Atsushi Enomoto <atsushi@ximian.com>
7 // Tim Coleman <tim@timcoleman.com>
9 // (C) 2002, 2003 Motus Technologies Inc. (http://www.motus.com)
10 // Copyright (C) Tim Coleman, 2004
11 // Copyright (C) 2004-2005 Novell, Inc (http://www.novell.com)
13 // Permission is hereby granted, free of charge, to any person obtaining
14 // a copy of this software and associated documentation files (the
15 // "Software"), to deal in the Software without restriction, including
16 // without limitation the rights to use, copy, modify, merge, publish,
17 // distribute, sublicense, and/or sell copies of the Software, and to
18 // permit persons to whom the Software is furnished to do so, subject to
19 // the following conditions:
21 // The above copyright notice and this permission notice shall be
22 // included in all copies or substantial portions of the Software.
24 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
25 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
26 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
27 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
28 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
29 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
30 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
33 using System.Collections;
35 using System.Runtime.InteropServices;
36 using System.Security.Cryptography;
37 using System.Security.Policy;
43 using System.Security.Cryptography.X509Certificates;
46 namespace System.Security.Cryptography.Xml {
48 public class SignedXml {
50 public const string XmlDsigCanonicalizationUrl = "http://www.w3.org/TR/2001/REC-xml-c14n-20010315";
51 public const string XmlDsigCanonicalizationWithCommentsUrl = XmlDsigCanonicalizationUrl + "#WithComments";
52 public const string XmlDsigDSAUrl = XmlDsigNamespaceUrl + "dsa-sha1";
53 public const string XmlDsigHMACSHA1Url = XmlDsigNamespaceUrl + "hmac-sha1";
54 public const string XmlDsigMinimalCanonicalizationUrl = XmlDsigNamespaceUrl + "minimal";
55 public const string XmlDsigNamespaceUrl = "http://www.w3.org/2000/09/xmldsig#";
56 public const string XmlDsigRSASHA1Url = XmlDsigNamespaceUrl + "rsa-sha1";
57 public const string XmlDsigSHA1Url = XmlDsigNamespaceUrl + "sha1";
60 public const string XmlDecryptionTransformUrl = "http://www.w3.org/2002/07/decrypt#XML";
61 public const string XmlDsigBase64TransformUrl = XmlDsigNamespaceUrl + "base64";
62 public const string XmlDsigC14NTransformUrl = XmlDsigCanonicalizationUrl;
63 public const string XmlDsigC14NWithCommentsTransformUrl = XmlDsigCanonicalizationWithCommentsUrl;
64 public const string XmlDsigEnvelopedSignatureTransformUrl = XmlDsigNamespaceUrl + "enveloped-signature";
65 public const string XmlDsigExcC14NTransformUrl = "http://www.w3.org/2001/10/xml-exc-c14n#";
66 public const string XmlDsigExcC14NWithCommentsTransformUrl = XmlDsigExcC14NTransformUrl + "WithComments";
67 public const string XmlDsigXPathTransformUrl = "http://www.w3.org/TR/1999/REC-xpath-19991116";
68 public const string XmlDsigXsltTransformUrl = "http://www.w3.org/TR/1999/REC-xslt-19991116";
69 public const string XmlLicenseTransformUrl = "urn:mpeg:mpeg21:2003:01-REL-R-NS:licenseTransform";
71 private EncryptedXml encryptedXml;
74 protected Signature m_signature;
75 private AsymmetricAlgorithm key;
76 protected string m_strSigningKeyName;
77 private XmlDocument envdoc;
78 private IEnumerator pkEnumerator;
79 private XmlElement signatureElement;
80 private Hashtable hashes;
81 // FIXME: enable it after CAS implementation
83 private XmlResolver xmlResolver = new XmlSecureResolver (new XmlUrlResolver (), new Evidence ());
85 private XmlResolver xmlResolver = new XmlUrlResolver ();
87 private ArrayList manifests;
89 private IEnumerator _x509Enumerator;
92 private static readonly char [] whitespaceChars = new char [] {' ', '\r', '\n', '\t'};
96 m_signature = new Signature ();
97 m_signature.SignedInfo = new SignedInfo ();
98 hashes = new Hashtable (2); // 98% SHA1 for now
101 public SignedXml (XmlDocument document) : this ()
103 if (document == null)
104 throw new ArgumentNullException ("document");
108 public SignedXml (XmlElement elem) : this ()
111 throw new ArgumentNullException ("elem");
112 envdoc = new XmlDocument ();
113 envdoc.LoadXml (elem.OuterXml);
118 public EncryptedXml EncryptedXml {
119 get { return encryptedXml; }
120 set { encryptedXml = value; }
124 public KeyInfo KeyInfo {
127 if (m_signature.KeyInfo == null)
128 m_signature.KeyInfo = new KeyInfo ();
130 return m_signature.KeyInfo;
132 set { m_signature.KeyInfo = value; }
135 public Signature Signature {
136 get { return m_signature; }
139 public string SignatureLength {
140 get { return m_signature.SignedInfo.SignatureLength; }
143 public string SignatureMethod {
144 get { return m_signature.SignedInfo.SignatureMethod; }
147 public byte[] SignatureValue {
148 get { return m_signature.SignatureValue; }
151 public SignedInfo SignedInfo {
152 get { return m_signature.SignedInfo; }
155 public AsymmetricAlgorithm SigningKey {
160 // NOTE: CryptoAPI related ? documented as fx internal
161 public string SigningKeyName {
162 get { return m_strSigningKeyName; }
163 set { m_strSigningKeyName = value; }
166 public void AddObject (DataObject dataObject)
168 m_signature.AddObject (dataObject);
171 public void AddReference (Reference reference)
174 if (reference == null)
175 throw new ArgumentNullException ("reference");
177 m_signature.SignedInfo.AddReference (reference);
180 private Stream ApplyTransform (Transform t, XmlDocument input)
182 // These transformer modify input document, which should
183 // not affect to the input itself.
184 if (t is XmlDsigXPathTransform
185 || t is XmlDsigEnvelopedSignatureTransform
187 || t is XmlDecryptionTransform
190 input = (XmlDocument) input.Clone ();
194 if (t is XmlDsigEnvelopedSignatureTransform)
195 // It returns XmlDocument for XmlDocument input.
196 return CanonicalizeOutput (t.GetOutput ());
198 object obj = t.GetOutput ();
201 else if (obj is XmlDocument) {
202 MemoryStream ms = new MemoryStream ();
203 XmlTextWriter xtw = new XmlTextWriter (ms, Encoding.UTF8);
204 ((XmlDocument) obj).WriteTo (xtw);
208 // Rewind to the start of the stream
212 else if (obj == null) {
213 throw new NotImplementedException ("This should not occur. Transform is " + t + ".");
216 // e.g. XmlDsigXPathTransform returns XmlNodeList
217 return CanonicalizeOutput (obj);
221 private Stream CanonicalizeOutput (object obj)
223 Transform c14n = GetC14NMethod ();
224 c14n.LoadInput (obj);
225 return (Stream) c14n.GetOutput ();
228 private XmlDocument GetManifest (Reference r)
230 XmlDocument doc = new XmlDocument ();
231 doc.PreserveWhitespace = true;
233 if (r.Uri [0] == '#') {
235 if (signatureElement != null) {
236 XmlElement xel = GetIdElement (signatureElement.OwnerDocument, r.Uri.Substring (1));
238 throw new CryptographicException ("Manifest targeted by Reference was not found: " + r.Uri.Substring (1));
239 doc.AppendChild (doc.ImportNode (xel, true));
240 FixupNamespaceNodes (xel, doc.DocumentElement, false);
243 else if (xmlResolver != null) {
244 // TODO: need testing
245 Stream s = (Stream) xmlResolver.GetEntity (new Uri (r.Uri), null, typeof (Stream));
249 if (doc.FirstChild != null) {
250 // keep a copy of the manifests to check their references later
251 if (manifests == null)
252 manifests = new ArrayList ();
260 private void FixupNamespaceNodes (XmlElement src, XmlElement dst, bool ignoreDefault)
262 // add namespace nodes
263 foreach (XmlAttribute attr in src.SelectNodes ("namespace::*")) {
264 if (attr.LocalName == "xml")
266 if (ignoreDefault && attr.LocalName == "xmlns")
268 dst.SetAttributeNode (dst.OwnerDocument.ImportNode (attr, true) as XmlAttribute);
272 private byte[] GetReferenceHash (Reference r, bool check_hmac)
275 XmlDocument doc = null;
276 if (r.Uri == String.Empty) {
279 else if (r.Type == XmlSignature.Uri.Manifest) {
280 doc = GetManifest (r);
283 doc = new XmlDocument ();
284 doc.PreserveWhitespace = true;
285 string objectName = null;
287 if (r.Uri.StartsWith ("#xpointer")) {
288 string uri = string.Join ("", r.Uri.Substring (9).Split (whitespaceChars));
289 if (uri.Length < 2 || uri [0] != '(' || uri [uri.Length - 1] != ')')
290 // FIXME: how to handle invalid xpointer?
293 uri = uri.Substring (1, uri.Length - 2);
296 else if (uri.Length > 6 && uri.StartsWith ("id(") && uri [uri.Length - 1] == ')')
297 // id('foo'), id("foo")
298 objectName = uri.Substring (4, uri.Length - 6);
300 else if (r.Uri [0] == '#') {
301 objectName = r.Uri.Substring (1);
303 else if (xmlResolver != null) {
304 // TODO: test but doc says that Resolver = null -> no access
306 // no way to know if valid without throwing an exception
307 Uri uri = new Uri (r.Uri);
308 s = (Stream) xmlResolver.GetEntity (uri, null, typeof (Stream));
311 // may still be a local file (and maybe not xml)
312 s = File.OpenRead (r.Uri);
315 if (objectName != null) {
316 XmlElement found = null;
317 foreach (DataObject obj in m_signature.ObjectList) {
318 if (obj.Id == objectName) {
319 found = obj.GetXml ();
320 found.SetAttribute ("xmlns", SignedXml.XmlDsigNamespaceUrl);
321 doc.AppendChild (doc.ImportNode (found, true));
322 // FIXME: there should be theoretical justification of copying namespace declaration nodes this way.
323 foreach (XmlNode n in found.ChildNodes)
324 // Do not copy default namespace as it must be xmldsig namespace for "Object" element.
325 if (n.NodeType == XmlNodeType.Element)
326 FixupNamespaceNodes (n as XmlElement, doc.DocumentElement, true);
330 if (found == null && envdoc != null) {
331 found = GetIdElement (envdoc, objectName);
333 doc.AppendChild (doc.ImportNode (found, true));
334 FixupNamespaceNodes (found, doc.DocumentElement, false);
338 throw new CryptographicException (String.Format ("Malformed reference object: {0}", objectName));
342 if (r.TransformChain.Count > 0) {
343 foreach (Transform t in r.TransformChain) {
345 s = ApplyTransform (t, doc);
349 object o = t.GetOutput ();
353 s = CanonicalizeOutput (o);
357 else if (s == null) {
358 // we must not C14N references from outside the document
359 // e.g. non-xml documents
360 if (r.Uri [0] != '#') {
361 s = new MemoryStream ();
365 // apply default C14N transformation
366 s = ApplyTransform (new XmlDsigC14NTransform (), doc);
369 HashAlgorithm digest = GetHash (r.DigestMethod, check_hmac);
370 return (digest == null) ? null : digest.ComputeHash (s);
373 private void DigestReferences ()
375 // we must tell each reference which hash algorithm to use
376 // before asking for the SignedInfo XML !
377 foreach (Reference r in m_signature.SignedInfo.References) {
378 // assume SHA-1 if nothing is specified
379 if (r.DigestMethod == null)
380 r.DigestMethod = XmlDsigSHA1Url;
381 r.DigestValue = GetReferenceHash (r, false);
385 private Transform GetC14NMethod ()
387 Transform t = (Transform) CryptoConfig.CreateFromName (m_signature.SignedInfo.CanonicalizationMethod);
389 throw new CryptographicException ("Unknown Canonicalization Method {0}", m_signature.SignedInfo.CanonicalizationMethod);
393 private Stream SignedInfoTransformed ()
395 Transform t = GetC14NMethod ();
397 if (signatureElement == null) {
398 // when creating signatures
399 XmlDocument doc = new XmlDocument ();
400 doc.PreserveWhitespace = true;
401 doc.LoadXml (m_signature.SignedInfo.GetXml ().OuterXml);
403 foreach (XmlAttribute attr in envdoc.DocumentElement.SelectNodes ("namespace::*")) {
404 if (attr.LocalName == "xml")
406 if (attr.Prefix == doc.DocumentElement.Prefix)
408 doc.DocumentElement.SetAttributeNode (doc.ImportNode (attr, true) as XmlAttribute);
413 // when verifying signatures
414 // TODO - check m_signature.SignedInfo.Id
415 XmlElement el = signatureElement.GetElementsByTagName (XmlSignature.ElementNames.SignedInfo, XmlSignature.NamespaceURI) [0] as XmlElement;
416 StringWriter sw = new StringWriter ();
417 XmlTextWriter xtw = new XmlTextWriter (sw);
418 xtw.WriteStartElement (el.Prefix, el.LocalName, el.NamespaceURI);
420 // context namespace nodes (except for "xmlns:xml")
421 XmlNodeList nl = el.SelectNodes ("namespace::*");
422 foreach (XmlAttribute attr in nl) {
423 if (attr.ParentNode == el)
425 if (attr.LocalName == "xml")
427 if (attr.Prefix == el.Prefix)
431 foreach (XmlNode attr in el.Attributes)
433 foreach (XmlNode n in el.ChildNodes)
436 xtw.WriteEndElement ();
437 byte [] si = Encoding.UTF8.GetBytes (sw.ToString ());
439 MemoryStream ms = new MemoryStream ();
440 ms.Write (si, 0, si.Length);
445 // C14N and C14NWithComments always return a Stream in GetOutput
446 return (Stream) t.GetOutput ();
449 // reuse hash - most document will always use the same hash
450 private HashAlgorithm GetHash (string algorithm, bool check_hmac)
452 HashAlgorithm hash = (HashAlgorithm) hashes [algorithm];
454 hash = HashAlgorithm.Create (algorithm);
456 throw new CryptographicException ("Unknown hash algorithm: {0}", algorithm);
457 hashes.Add (algorithm, hash);
458 // now ready to be used
461 // important before reusing an hash object
464 // we can sign using any hash algorith, including HMAC, but we can only verify hash (MS compatibility)
465 if (check_hmac && (hash is KeyedHashAlgorithm))
470 public bool CheckSignature ()
472 return (CheckSignatureInternal (null) != null);
475 private bool CheckReferenceIntegrity (ArrayList referenceList)
477 if (referenceList == null)
480 // check digest (hash) for every reference
481 foreach (Reference r in referenceList) {
482 // stop at first broken reference
483 byte[] hash = GetReferenceHash (r, true);
484 if (! Compare (r.DigestValue, hash))
490 public bool CheckSignature (AsymmetricAlgorithm key)
493 throw new ArgumentNullException ("key");
494 return (CheckSignatureInternal (key) != null);
497 private AsymmetricAlgorithm CheckSignatureInternal (AsymmetricAlgorithm key)
502 // check with supplied key
503 if (!CheckSignatureWithKey (key))
507 if (Signature.KeyInfo == null)
510 if (Signature.KeyInfo == null)
511 throw new CryptographicException ("At least one KeyInfo is required.");
513 // no supplied key, iterates all KeyInfo
514 while ((key = GetPublicKey ()) != null) {
515 if (CheckSignatureWithKey (key)) {
524 // some parts may need to be downloaded
525 // so where doing it last
526 if (!CheckReferenceIntegrity (m_signature.SignedInfo.References))
529 if (manifests != null) {
530 // do not use foreach as a manifest could contain manifests...
531 for (int i=0; i < manifests.Count; i++) {
532 Manifest manifest = new Manifest ((manifests [i] as XmlDocument).DocumentElement);
533 if (! CheckReferenceIntegrity (manifest.References))
540 // Is the signature (over SignedInfo) valid ?
541 private bool CheckSignatureWithKey (AsymmetricAlgorithm key)
546 SignatureDescription sd = (SignatureDescription) CryptoConfig.CreateFromName (m_signature.SignedInfo.SignatureMethod);
550 AsymmetricSignatureDeformatter verifier = (AsymmetricSignatureDeformatter) CryptoConfig.CreateFromName (sd.DeformatterAlgorithm);
551 if (verifier == null)
555 verifier.SetKey (key);
556 verifier.SetHashAlgorithm (sd.DigestAlgorithm);
558 HashAlgorithm hash = GetHash (sd.DigestAlgorithm, true);
559 // get the hash of the C14N SignedInfo element
560 MemoryStream ms = (MemoryStream) SignedInfoTransformed ();
562 byte[] digest = hash.ComputeHash (ms);
563 return verifier.VerifySignature (digest, m_signature.SignatureValue);
566 // e.g. SignatureMethod != AsymmetricAlgorithm type
571 private bool Compare (byte[] expected, byte[] actual)
573 bool result = ((expected != null) && (actual != null));
575 int l = expected.Length;
576 result = (l == actual.Length);
578 for (int i=0; i < l; i++) {
579 if (expected[i] != actual[i])
587 public bool CheckSignature (KeyedHashAlgorithm macAlg)
590 throw new ArgumentNullException ("macAlg");
594 // Is the signature (over SignedInfo) valid ?
595 Stream s = SignedInfoTransformed ();
599 byte[] actual = macAlg.ComputeHash (s);
600 // HMAC signature may be partial and specified by <HMACOutputLength>
601 if (m_signature.SignedInfo.SignatureLength != null) {
602 int length = Int32.Parse (m_signature.SignedInfo.SignatureLength);
603 // we only support signatures with a multiple of 8 bits
604 // and the value must match the signature length
605 if ((length & 7) != 0)
606 throw new CryptographicException ("Signature length must be a multiple of 8 bits.");
608 // SignatureLength is in bits (and we works on bytes, only in multiple of 8 bits)
609 // and both values must match for a signature to be valid
611 if (length != m_signature.SignatureValue.Length)
612 throw new CryptographicException ("Invalid signature length.");
614 // is the length "big" enough to make the signature meaningful ?
615 // we use a minimum of 80 bits (10 bytes) or half the HMAC normal output length
616 // e.g. HMACMD5 output 128 bits but our minimum is 80 bits (not 64 bits)
617 int minimum = Math.Max (10, actual.Length / 2);
618 if (length < minimum)
619 throw new CryptographicException ("HMAC signature is too small");
621 if (length < actual.Length) {
622 byte[] trunked = new byte [length];
623 Buffer.BlockCopy (actual, 0, trunked, 0, length);
628 if (Compare (m_signature.SignatureValue, actual)) {
629 // some parts may need to be downloaded
630 // so where doing it last
631 return CheckReferenceIntegrity (m_signature.SignedInfo.References);
639 public bool CheckSignature (X509Certificate2 certificate, bool verifySignatureOnly)
641 throw new NotImplementedException ();
645 public bool CheckSignatureReturningKey (out AsymmetricAlgorithm signingKey)
647 signingKey = CheckSignatureInternal (null);
648 return (signingKey != null);
651 public void ComputeSignature ()
654 if (m_signature.SignedInfo.SignatureMethod == null)
655 // required before hashing
656 m_signature.SignedInfo.SignatureMethod = key.SignatureAlgorithm;
657 else if (m_signature.SignedInfo.SignatureMethod != key.SignatureAlgorithm)
658 throw new CryptographicException ("Specified SignatureAlgorithm is not supported by the signing key.");
661 AsymmetricSignatureFormatter signer = null;
662 // in need for a CryptoConfig factory
664 signer = new DSASignatureFormatter (key);
666 signer = new RSAPKCS1SignatureFormatter (key);
668 if (signer != null) {
669 SignatureDescription sd = (SignatureDescription) CryptoConfig.CreateFromName (m_signature.SignedInfo.SignatureMethod);
671 HashAlgorithm hash = GetHash (sd.DigestAlgorithm, false);
672 // get the hash of the C14N SignedInfo element
673 byte[] digest = hash.ComputeHash (SignedInfoTransformed ());
675 signer.SetHashAlgorithm ("SHA1");
676 m_signature.SignatureValue = signer.CreateSignature (digest);
680 throw new CryptographicException ("signing key is not specified");
683 public void ComputeSignature (KeyedHashAlgorithm macAlg)
686 throw new ArgumentNullException ("macAlg");
688 string method = null;
690 if (macAlg is HMACSHA1) {
691 method = XmlDsigHMACSHA1Url;
693 } else if (macAlg is HMACSHA256) {
694 method = "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256";
695 } else if (macAlg is HMACSHA384) {
696 method = "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384";
697 } else if (macAlg is HMACSHA512) {
698 method = "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512";
699 } else if (macAlg is HMACRIPEMD160) {
700 method = "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160";
705 throw new CryptographicException ("unsupported algorithm");
708 m_signature.SignedInfo.SignatureMethod = method;
709 m_signature.SignatureValue = macAlg.ComputeHash (SignedInfoTransformed ());
712 public virtual XmlElement GetIdElement (XmlDocument document, string idValue)
714 if ((document == null) || (idValue == null))
717 // this works only if there's a DTD or XSD available to define the ID
718 XmlElement xel = document.GetElementById (idValue);
720 // search an "undefined" ID
721 xel = (XmlElement) document.SelectSingleNode ("//*[@Id='" + idValue + "']");
726 // According to book ".NET Framework Security" this method
727 // iterates all possible keys then return null
728 protected virtual AsymmetricAlgorithm GetPublicKey ()
730 if (m_signature.KeyInfo == null)
733 if (pkEnumerator == null) {
734 pkEnumerator = m_signature.KeyInfo.GetEnumerator ();
737 #if NET_2_0 && SECURITY_DEP
738 if (_x509Enumerator != null) {
739 if (_x509Enumerator.MoveNext ()) {
740 X509Certificate cert = (X509Certificate) _x509Enumerator.Current;
741 return new X509Certificate2 (cert.GetRawCertData ()).PublicKey.Key;
743 _x509Enumerator = null;
747 while (pkEnumerator.MoveNext ()) {
748 AsymmetricAlgorithm key = null;
749 KeyInfoClause kic = (KeyInfoClause) pkEnumerator.Current;
751 if (kic is DSAKeyValue)
753 else if (kic is RSAKeyValue)
757 key.FromXmlString (kic.GetXml ().InnerXml);
761 #if NET_2_0 && SECURITY_DEP
762 if (kic is KeyInfoX509Data) {
763 _x509Enumerator = ((KeyInfoX509Data) kic).Certificates.GetEnumerator ();
764 if (_x509Enumerator.MoveNext ()) {
765 X509Certificate cert = (X509Certificate) _x509Enumerator.Current;
766 return new X509Certificate2 (cert.GetRawCertData ()).PublicKey.Key;
774 public XmlElement GetXml ()
776 return m_signature.GetXml (envdoc);
779 public void LoadXml (XmlElement value)
782 throw new ArgumentNullException ("value");
784 signatureElement = value;
785 m_signature.LoadXml (value);
787 // Need to give the EncryptedXml object to the
788 // XmlDecryptionTransform to give it a fighting
789 // chance at decrypting the document.
790 foreach (Reference r in m_signature.SignedInfo.References) {
791 foreach (Transform t in r.TransformChain) {
792 if (t is XmlDecryptionTransform)
793 ((XmlDecryptionTransform) t).EncryptedXml = EncryptedXml;
801 public XmlResolver Resolver {
802 set { xmlResolver = value; }