我对 C# 很陌生,尤其是使用 X509 签名。我有一个 xml 模板,必须在其中添加使用的证书(完成)并签署时间戳 (TS-1)、二进制安全令牌和正文 (id-1)。
此外,我需要用这 3 个元素的摘要值写入(例如替换占位符)并添加签名值。
但是,我不太理解这个概念,例如这个怎么做。我读了几个网站,例如使用 x509 证书签署 xml 文档 https://stackoverflow.com/questions/23394654/signing-a-xml-document-with-x509-certificate但我无法使代码适应我的问题。
这是我尝试过的:
public static string SignXml(string template)
{
XmlDocument document = new XmlDocument();
document.LoadXml(template);
// define elements that will be signed
XmlNode securityToken = null;
XmlNode validityPeriod = null;
XmlNode body = null;
XmlNode signedInfo = null;
XmlNode signatureValue = null;
XmlNodeList digestTags = null;
XmlNamespaceManager namespaces = new XmlNamespaceManager(document.NameTable);
namespaces.AddNamespace("ns", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
namespaces.AddNamespace("nu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
namespaces.AddNamespace("bo", "http://schemas.xmlsoap.org/soap/envelope/");
namespaces.AddNamespace("si", "http://www.w3.org/2000/09/xmldsig#");
namespaces.AddNamespace("sinfo", "soapenv xd xe");
document.LoadXml(template);
//XmlNode idNode = document.SelectSingleNode("/My_RootNode/ns:id", namespaces);
securityToken = document.SelectSingleNode("descendant::ns:BinarySecurityToken", namespaces);
validityPeriod = document.SelectSingleNode("descendant::nu:Timestamp", namespaces);
body = document.SelectSingleNode("descendant::bo:Body", namespaces);
signedInfo = document.SelectSingleNode("descendant::si:SignedInfo", namespaces);
signatureValue = document.SelectSingleNode("descendant::si::sinfo:SignatureValue", namespaces);
digestTags = document.SelectNodes("descendant::si:DigestValue", namespaces);
// add the digests (to know where to write the digests)
String nodeName = null;
for (int counter = 0; counter < digestTags.Count; counter++)
{
nodeName = digestTags[counter].FirstChild.InnerText;
if (WebserviceConstants.PLACEHOLDER_AUTHNREQUEST_DIGEST.Equals(nodeName))
{
generateDigest(body, digestTags[counter]);
}
else if (WebserviceConstants.PLACEHOLDER_CERTIFICATE_DIGEST.Equals(nodeName))
{
generateDigest(securityToken, digestTags[counter]);
}
else if (WebserviceConstants.PLACEHOLDER_TIMESTAMP_TAG_DIGEST.Equals(nodeName))
{
generateDigest(validityPeriod, digestTags[counter]);
}
}
SignedXml signedXml = new SignedXml(document);
X509Certificate2 cert = new X509Certificate2();
cert = getbase();
signedXml.SigningKey = cert.PrivateKey;
// Create a reference to be signed.
Reference reference = new Reference();
reference.Uri = "#TS-1";
// Add an enveloped transformation to the reference.
XmlDsigEnvelopedSignatureTransform env =
new XmlDsigEnvelopedSignatureTransform(true);
reference.AddTransform(env);
//canonicalize
XmlDsigC14NTransform c14t = new XmlDsigC14NTransform();
reference.AddTransform(c14t);
KeyInfo keyInfo = new KeyInfo();
KeyInfoX509Data keyInfoData = new KeyInfoX509Data(cert);
KeyInfoName kin = new KeyInfoName();
kin.Value = "Public key of certificate";
RSACryptoServiceProvider rsaprovider = (RSACryptoServiceProvider)cert.PublicKey.Key;
RSAKeyValue rkv = new RSAKeyValue(rsaprovider);
keyInfo.AddClause(kin);
keyInfo.AddClause(rkv);
keyInfo.AddClause(keyInfoData);
signedXml.KeyInfo = keyInfo;
// Add the reference to the SignedXml object.
signedXml.AddReference(reference);
// Compute the signature.
signedXml.ComputeSignature();
// Get the XML representation of the signature and save
// it to an XmlElement object.
XmlElement xmlDigitalSignature = signedXml.GetXml();
document.DocumentElement.AppendChild(
document.ImportNode(xmlDigitalSignature, true));
document.DocumentElement.AppendChild(document.ImportNode(xmlDigitalSignature, true));
return document.OuterXml;
}
}
我在质疑自己:
- 如何获取摘要值以及如何将其写入对应的xml节点
- 如何计算签名值,因为它“包含”所有 3 个引用的签名信息???
正如你所看到的,我缺少一些一般背景和理解。如果你能帮助我那就太好了!
谢谢