APIdia Launch Partner
Top Description Fields Constructors Methods
com.sun.org.apache.xml.internal.security.signature

public final Class XMLSignature

extends SignatureElementProxy
Class Inheritance
Imports
java.io.IOException, .OutputStream, java.security.Key, .Provider, .PublicKey, java.security.cert.X509Certificate, java.security.spec.AlgorithmParameterSpec, javax.crypto.SecretKey, com.sun.org.apache.xml.internal.security.algorithms.SignatureAlgorithm, com.sun.org.apache.xml.internal.security.c14n.Canonicalizer, com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityException, com.sun.org.apache.xml.internal.security.keys.KeyInfo, com.sun.org.apache.xml.internal.security.keys.content.X509Data, com.sun.org.apache.xml.internal.security.transforms.Transforms, com.sun.org.apache.xml.internal.security.utils.Constants, .I18n, .SignatureElementProxy, .SignerOutputStream, .UnsyncBufferedOutputStream, .XMLUtils, com.sun.org.apache.xml.internal.security.utils.resolver.ResourceResolverSpi, org.w3c.dom.Attr, .Document, .Element, .Node, .Text
Handles <ds:Signature> elements. This is the main class that deals with creating and verifying signatures.

There are 2 types of constructors for this class. The ones that take a document, baseURI and 1 or more Java Objects. This is mostly used for signing purposes. The other constructor is the one that takes a DOM Element and a baseURI. This is used mostly with for verifying, when you have a SignatureElement. There are a few different types of methods:

Field Summary

Modifier and TypeField and Description
public static final String
ALGO_ID_MAC_HMAC_RIPEMD160

HMAC - Optional HMAC-RIPEMD160

public static final String
ALGO_ID_MAC_HMAC_SHA1

MAC - Required HMAC-SHA1

public static final String
ALGO_ID_MAC_HMAC_SHA224

HMAC - Optional HMAC-SHA2224

public static final String
ALGO_ID_MAC_HMAC_SHA256

HMAC - Optional HMAC-SHA256

public static final String
ALGO_ID_MAC_HMAC_SHA384

HMAC - Optional HMAC-SHA284

public static final String
ALGO_ID_MAC_HMAC_SHA512

HMAC - Optional HMAC-SHA512

public static final String
ALGO_ID_SIGNATURE_DSA

Signature - Required DSAwithSHA1 (DSS)

public static final String
ALGO_ID_SIGNATURE_DSA_SHA256

Signature - Optional DSAwithSHA256

public static final String
ALGO_ID_SIGNATURE_ECDSA_RIPEMD160

Signature - Optional ECDSAwithRIPEMD160

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA1

Signature - Optional ECDSAwithSHA1

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA224

Signature - Optional ECDSAwithSHA224

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA256

Signature - Optional ECDSAwithSHA256

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA384

Signature - Optional ECDSAwithSHA384

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA3_224

Signature - SHA3-224withECDSA

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA3_256

Signature - SHA3-256withECDSA

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA3_384

Signature - SHA3-384withECDSA

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA3_512

Signature - SHA3-512withECDSA

public static final String
ALGO_ID_SIGNATURE_ECDSA_SHA512

Signature - Optional ECDSAwithSHA512

public static final String
ALGO_ID_SIGNATURE_EDDSA_ED25519

Signature - EDDSA ED25519

public static final String
ALGO_ID_SIGNATURE_EDDSA_ED448

Signature - EDDSA ED448

public static final String
ALGO_ID_SIGNATURE_RSA

Signature - Recommended RSAwithSHA1

public static final String
ALGO_ID_SIGNATURE_RSA_PSS

Signature - Optional RSASSA-PSS

public static final String
ALGO_ID_SIGNATURE_RSA_RIPEMD160

Signature - Optional RSAwithRIPEMD160

public static final String
ALGO_ID_SIGNATURE_RSA_SHA1

Signature - Recommended RSAwithSHA1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA1_MGF1

Signature - Optional RSAwithSHA1andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA224

Signature - Optional RSAwithSHA224

public static final String
ALGO_ID_SIGNATURE_RSA_SHA224_MGF1

Signature - Optional RSAwithSHA224andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA256

Signature - Optional RSAwithSHA256

public static final String
ALGO_ID_SIGNATURE_RSA_SHA256_MGF1

Signature - Optional RSAwithSHA256andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA384

Signature - Optional RSAwithSHA384

public static final String
ALGO_ID_SIGNATURE_RSA_SHA384_MGF1

Signature - Optional RSAwithSHA384andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA3_224_MGF1

Signature - Optional RSAwithSHA3_224andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA3_256_MGF1

Signature - Optional RSAwithSHA3_256andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA3_384_MGF1

Signature - Optional RSAwithSHA3_384andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA3_512_MGF1

Signature - Optional RSAwithSHA3_512andMGF1

public static final String
ALGO_ID_SIGNATURE_RSA_SHA512

Signature - Optional RSAwithSHA512

public static final String
ALGO_ID_SIGNATURE_RSA_SHA512_MGF1

Signature - Optional RSAwithSHA512andMGF1

private boolean
followManifestsDuringValidation

Checking the digests in References in a Signature are mandatory, but for References inside a Manifest it is application specific.

private KeyInfo
keyInfo

ds:Signature.ds:KeyInfo

private static final Logger
LOG

Hides com.sun.org.apache.xml.internal.security.utils.ElementProxy.LOG.

private static final int
MODE_SIGN

private static final int
MODE_VERIFY

private Element
signatureValueElement

private final SignedInfo
signedInfo

ds:Signature.ds:SignedInfo element

private int
state

Constructor Summary

AccessConstructor and Description
public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
signature algorithm to use.
signatureMethodURI)

This creates a new ds:Signature Element and adds an empty ds:SignedInfo.

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
signature algorithm to use.
signatureMethodURI, Provider
security provider to use.
provider)

This creates a new ds:Signature Element and adds an empty ds:SignedInfo.

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
the Signature method to be used.
signatureMethodURI, int hmacOutputLength)

Constructor XMLSignature

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
the Signature method to be used.
signatureMethodURI, int hmacOutputLength, Provider
security provider to use.
provider)

Constructor XMLSignature

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
the Signature method to be used.
signatureMethodURI, String
the canonicalization algorithm to be used to c14nize the SignedInfo element.
canonicalizationMethodURI)

Constructor XMLSignature

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
the Signature method to be used.
signatureMethodURI, String
the canonicalization algorithm to be used to c14nize the SignedInfo element.
canonicalizationMethodURI, Provider
security provider to use.
provider)

Constructor XMLSignature

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
the Signature method to be used.
signatureMethodURI, int hmacOutputLength, String
the canonicalization algorithm to be used to c14nize the SignedInfo element.
canonicalizationMethodURI)

Constructor XMLSignature

public
XMLSignature(Document
Document in which the signature will be appended after creation.
doc, String
URI to be used as context for all relative URIs.
baseURI, String
the Signature method to be used.
signatureMethodURI, int hmacOutputLength, String
the canonicalization algorithm to be used to c14nize the SignedInfo element.
canonicalizationMethodURI, Provider
security provider to use.
provider, AlgorithmParameterSpec spec)

Constructor XMLSignature

public
XMLSignature(Document doc, String baseURI, Element signatureMethodElem, Element canonicalizationMethodElem)

Creates a XMLSignature in a Document

public
XMLSignature(Document doc, String baseURI, Element signatureMethodElem, Element canonicalizationMethodElem, Provider provider)

public
XMLSignature(Element
ds:Signature element that contains the whole signature
element, String
URI to be prepended to all relative URIs
baseURI)

This will parse the element and construct the Java Objects.

public
XMLSignature(Element
ds:Signature element that contains the whole signature
element, String
URI to be prepended to all relative URIs
baseURI, Provider
security provider to use
provider)

This will parse the element and construct the Java Objects.

public
XMLSignature(Element
ds:Signature element that contains the whole signature
element, String
URI to be prepended to all relative URIs
baseURI, boolean
whether secure secureValidation is enabled or not
secureValidation)

This will parse the element and construct the Java Objects.

public
XMLSignature(Element
ds:Signature element that contains the whole signature
element, String
URI to be prepended to all relative URIs
baseURI, boolean
whether secure secureValidation is enabled or not
secureValidation, Provider
security provider to use
provider)

This will parse the element and construct the Java Objects.

Method Summary

Modifier and TypeMethod and Description
public void
addDocument(String
URI of the resource to be signed. Can be null in which case the dereferencing is application specific. Can be "" in which it's the parent node (or parent document?). There can only be one "" in each signature.
referenceURI, Transforms
Optional list of transformations to be done before digesting
trans, String
Mandatory URI of the digesting algorithm to use.
digestURI, String
Optional id attribute for this Reference
referenceId, String
Optional mimetype for the URI
referenceType)

Add a Reference with full parameters to this Signature

public void
addDocument(String
URI according to the XML Signature specification.
referenceURI, Transforms
List of transformations to be applied.
trans, String
URI of the digest algorithm to be used.
digestURI)

This method is a proxy method for the Manifest#addDocument method.

public void
addDocument(String
URI according to the XML Signature specification.
referenceURI, Transforms
List of transformations to be applied.
trans)

Adds a Reference with just the URI and the transforms.

public void
addDocument(String
URI according to the XML Signature specification.
referenceURI)

Add a Reference with just this URI.

public void
addKeyInfo(X509Certificate
Certificate to be included. This should be the certificate of the key that was used to sign.
cert)

Add an X509 Certificate to the KeyInfo.

public void
addKeyInfo(PublicKey pk)

Add this public key to the KeyInfo.

public void
addResourceResolver(ResourceResolverSpi resolver)

Adds a ResourceResolverSpi to enable the retrieval of resources.

public void
appendObject(ObjectContainer
ds:Object to be appended.
object)

Appends an Object (not a java.lang.Object but an Object element) to the Signature.

public boolean

Returns:

true if the signature is valid, false otherwise
checkSignatureValue(X509Certificate
Certificate that contains the public key part of the keypair that was used to sign.
cert)

Extracts the public key from the certificate and verifies if the signature is valid by re-digesting all References, comparing those against the stored DigestValues and then checking to see if the Signatures match on the SignedInfo.

public boolean

Returns:

true if the signature is valid, false otherwise
checkSignatureValue(Key
java.security.PublicKey part of the keypair or javax.crypto.SecretKey that was used to sign
pk)

Verifies if the signature is valid by redigesting all References, comparing those against the stored DigestValues and then checking to see if the Signatures match on the SignedInfo.

public SecretKey

Returns:

the secret key created.
createSecretKey(byte[] secretKeyBytes)

Proxy method for SignedInfo#createSecretKey(byte[]).

public String

Returns:

Constants._TAG_SIGNATURE
getBaseLocalName()

Implements abstract com.sun.org.apache.xml.internal.security.utils.ElementProxy.getBaseLocalName.

Get the local name of this element

public String

Returns:

the Id attribute
getId()

Returns the Id attribute

public KeyInfo

Returns:

the KeyInfo object
getKeyInfo()

Returns the KeyInfo child.

public ObjectContainer

Returns:

the ith ds:Object child of the signature or null if no such ds:Object element exists.
getObjectItem(int i)

Returns the ith ds:Object child of the signature or null if no such ds:Object element exists.

public int

Returns:

the number of all ds:Object elements.
getObjectLength()

Returns the number of all ds:Object elements.

public byte[]

Returns:

the value of the SignatureValue element.
getSignatureValue()

Returns the octet value of the SignatureValue element.

public SignedInfo

Returns:

the completely parsed SignedInfo object.
getSignedInfo()

Returns the completely parsed SignedInfo object.

public void
setFollowNestedManifests(boolean followManifests)

Signal whether Manifest should be automatically validated.

public void
setId(String
Id value for the id attribute on the Signature Element
id)

Sets the Id attribute

private void
setSignatureValueElement(byte[]
bytes to be used by SignatureValue before Base64 encoding
bytes)

Base64 encodes and sets the bytes as the content of the SignatureValue Node.

public void
sign(Key
the java.security.PrivateKey or javax.crypto.SecretKey that is used to sign.
signingKey)

Digests all References in the SignedInfo, calculates the signature value and sets it in the SignatureValue Element.

Inherited from com.sun.org.apache.xml.internal.security.utils.SignatureElementProxy:
getBaseNamespace

Field Detail

ALGO_ID_MAC_HMAC_RIPEMD160back to summary
public static final String ALGO_ID_MAC_HMAC_RIPEMD160

HMAC - Optional HMAC-RIPEMD160

ALGO_ID_MAC_HMAC_SHA1back to summary
public static final String ALGO_ID_MAC_HMAC_SHA1

MAC - Required HMAC-SHA1

ALGO_ID_MAC_HMAC_SHA224back to summary
public static final String ALGO_ID_MAC_HMAC_SHA224

HMAC - Optional HMAC-SHA2224

ALGO_ID_MAC_HMAC_SHA256back to summary
public static final String ALGO_ID_MAC_HMAC_SHA256

HMAC - Optional HMAC-SHA256

ALGO_ID_MAC_HMAC_SHA384back to summary
public static final String ALGO_ID_MAC_HMAC_SHA384

HMAC - Optional HMAC-SHA284

ALGO_ID_MAC_HMAC_SHA512back to summary
public static final String ALGO_ID_MAC_HMAC_SHA512

HMAC - Optional HMAC-SHA512

ALGO_ID_SIGNATURE_DSAback to summary
public static final String ALGO_ID_SIGNATURE_DSA

Signature - Required DSAwithSHA1 (DSS)

ALGO_ID_SIGNATURE_DSA_SHA256back to summary
public static final String ALGO_ID_SIGNATURE_DSA_SHA256

Signature - Optional DSAwithSHA256

ALGO_ID_SIGNATURE_ECDSA_RIPEMD160back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_RIPEMD160

Signature - Optional ECDSAwithRIPEMD160

ALGO_ID_SIGNATURE_ECDSA_SHA1back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA1

Signature - Optional ECDSAwithSHA1

ALGO_ID_SIGNATURE_ECDSA_SHA224back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA224

Signature - Optional ECDSAwithSHA224

ALGO_ID_SIGNATURE_ECDSA_SHA256back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA256

Signature - Optional ECDSAwithSHA256

ALGO_ID_SIGNATURE_ECDSA_SHA384back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA384

Signature - Optional ECDSAwithSHA384

ALGO_ID_SIGNATURE_ECDSA_SHA3_224back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_224

Signature - SHA3-224withECDSA

ALGO_ID_SIGNATURE_ECDSA_SHA3_256back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_256

Signature - SHA3-256withECDSA

ALGO_ID_SIGNATURE_ECDSA_SHA3_384back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_384

Signature - SHA3-384withECDSA

ALGO_ID_SIGNATURE_ECDSA_SHA3_512back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_512

Signature - SHA3-512withECDSA

ALGO_ID_SIGNATURE_ECDSA_SHA512back to summary
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA512

Signature - Optional ECDSAwithSHA512

ALGO_ID_SIGNATURE_EDDSA_ED25519back to summary
public static final String ALGO_ID_SIGNATURE_EDDSA_ED25519

Signature - EDDSA ED25519

ALGO_ID_SIGNATURE_EDDSA_ED448back to summary
public static final String ALGO_ID_SIGNATURE_EDDSA_ED448

Signature - EDDSA ED448

ALGO_ID_SIGNATURE_RSAback to summary
public static final String ALGO_ID_SIGNATURE_RSA

Signature - Recommended RSAwithSHA1

ALGO_ID_SIGNATURE_RSA_PSSback to summary
public static final String ALGO_ID_SIGNATURE_RSA_PSS

Signature - Optional RSASSA-PSS

ALGO_ID_SIGNATURE_RSA_RIPEMD160back to summary
public static final String ALGO_ID_SIGNATURE_RSA_RIPEMD160

Signature - Optional RSAwithRIPEMD160

ALGO_ID_SIGNATURE_RSA_SHA1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA1

Signature - Recommended RSAwithSHA1

ALGO_ID_SIGNATURE_RSA_SHA1_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA1_MGF1

Signature - Optional RSAwithSHA1andMGF1

ALGO_ID_SIGNATURE_RSA_SHA224back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA224

Signature - Optional RSAwithSHA224

ALGO_ID_SIGNATURE_RSA_SHA224_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA224_MGF1

Signature - Optional RSAwithSHA224andMGF1

ALGO_ID_SIGNATURE_RSA_SHA256back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA256

Signature - Optional RSAwithSHA256

ALGO_ID_SIGNATURE_RSA_SHA256_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA256_MGF1

Signature - Optional RSAwithSHA256andMGF1

ALGO_ID_SIGNATURE_RSA_SHA384back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA384

Signature - Optional RSAwithSHA384

ALGO_ID_SIGNATURE_RSA_SHA384_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA384_MGF1

Signature - Optional RSAwithSHA384andMGF1

ALGO_ID_SIGNATURE_RSA_SHA3_224_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA3_224_MGF1

Signature - Optional RSAwithSHA3_224andMGF1

ALGO_ID_SIGNATURE_RSA_SHA3_256_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA3_256_MGF1

Signature - Optional RSAwithSHA3_256andMGF1

ALGO_ID_SIGNATURE_RSA_SHA3_384_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA3_384_MGF1

Signature - Optional RSAwithSHA3_384andMGF1

ALGO_ID_SIGNATURE_RSA_SHA3_512_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA3_512_MGF1

Signature - Optional RSAwithSHA3_512andMGF1

ALGO_ID_SIGNATURE_RSA_SHA512back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA512

Signature - Optional RSAwithSHA512

ALGO_ID_SIGNATURE_RSA_SHA512_MGF1back to summary
public static final String ALGO_ID_SIGNATURE_RSA_SHA512_MGF1

Signature - Optional RSAwithSHA512andMGF1

followManifestsDuringValidationback to summary
private boolean followManifestsDuringValidation

Checking the digests in References in a Signature are mandatory, but for References inside a Manifest it is application specific. This boolean is to indicate that the References inside Manifests should be validated.

keyInfoback to summary
private KeyInfo keyInfo

ds:Signature.ds:KeyInfo

LOGback to summary
private static final Logger LOG

Hides com.sun.org.apache.xml.internal.security.utils.ElementProxy.LOG.

MODE_SIGNback to summary
private static final int MODE_SIGN
MODE_VERIFYback to summary
private static final int MODE_VERIFY
signatureValueElementback to summary
private Element signatureValueElement
signedInfoback to summary
private final SignedInfo signedInfo

ds:Signature.ds:SignedInfo element

stateback to summary
private int state

Constructor Detail

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI) throws XMLSecurityException

This creates a new ds:Signature Element and adds an empty ds:SignedInfo. The ds:SignedInfo is initialized with the specified Signature algorithm and Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS which is REQUIRED by the spec. This method's main use is for creating a new signature.

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

signature algorithm to use.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, Provider provider) throws XMLSecurityException

This creates a new ds:Signature Element and adds an empty ds:SignedInfo. The ds:SignedInfo is initialized with the specified Signature algorithm and Canonicalizer.ALGO_ID_C14N_OMIT_COMMENTS which is REQUIRED by the spec. This method's main use is for creating a new signature.

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

signature algorithm to use.

provider:Provider

security provider to use.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, int hmacOutputLength) throws XMLSecurityException

Constructor XMLSignature

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

the Signature method to be used.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, int hmacOutputLength, Provider provider) throws XMLSecurityException

Constructor XMLSignature

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

the Signature method to be used.

provider:Provider

security provider to use.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, String canonicalizationMethodURI) throws XMLSecurityException

Constructor XMLSignature

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

the Signature method to be used.

canonicalizationMethodURI:String

the canonicalization algorithm to be used to c14nize the SignedInfo element.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, String canonicalizationMethodURI, Provider provider) throws XMLSecurityException

Constructor XMLSignature

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

the Signature method to be used.

canonicalizationMethodURI:String

the canonicalization algorithm to be used to c14nize the SignedInfo element.

provider:Provider

security provider to use.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, int hmacOutputLength, String canonicalizationMethodURI) throws XMLSecurityException

Constructor XMLSignature

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

the Signature method to be used.

canonicalizationMethodURI:String

the canonicalization algorithm to be used to c14nize the SignedInfo element.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, String signatureMethodURI, int hmacOutputLength, String canonicalizationMethodURI, Provider provider, AlgorithmParameterSpec spec) throws XMLSecurityException

Constructor XMLSignature

Parameters
doc:Document

Document in which the signature will be appended after creation.

baseURI:String

URI to be used as context for all relative URIs.

signatureMethodURI:String

the Signature method to be used.

canonicalizationMethodURI:String

the canonicalization algorithm to be used to c14nize the SignedInfo element.

provider:Provider

security provider to use.

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, Element signatureMethodElem, Element canonicalizationMethodElem) throws XMLSecurityException

Creates a XMLSignature in a Document

XMLSignatureback to summary
public XMLSignature(Document doc, String baseURI, Element signatureMethodElem, Element canonicalizationMethodElem, Provider provider) throws XMLSecurityException
XMLSignatureback to summary
public XMLSignature(Element element, String baseURI) throws XMLSignatureException, XMLSecurityException

This will parse the element and construct the Java Objects. That will allow a user to validate the signature.

Parameters
element:Element

ds:Signature element that contains the whole signature

baseURI:String

URI to be prepended to all relative URIs

Exceptions
XMLSignatureException:
if the signature is badly formatted
XMLSignatureback to summary
public XMLSignature(Element element, String baseURI, Provider provider) throws XMLSignatureException, XMLSecurityException

This will parse the element and construct the Java Objects. That will allow a user to validate the signature.

Parameters
element:Element

ds:Signature element that contains the whole signature

baseURI:String

URI to be prepended to all relative URIs

provider:Provider

security provider to use

Exceptions
XMLSignatureException:
if the signature is badly formatted
XMLSignatureback to summary
public XMLSignature(Element element, String baseURI, boolean secureValidation) throws XMLSignatureException, XMLSecurityException

This will parse the element and construct the Java Objects. That will allow a user to validate the signature.

Parameters
element:Element

ds:Signature element that contains the whole signature

baseURI:String

URI to be prepended to all relative URIs

secureValidation:boolean

whether secure secureValidation is enabled or not

Exceptions
XMLSignatureException:
if the signature is badly formatted
XMLSignatureback to summary
public XMLSignature(Element element, String baseURI, boolean secureValidation, Provider provider) throws XMLSignatureException, XMLSecurityException

This will parse the element and construct the Java Objects. That will allow a user to validate the signature.

Parameters
element:Element

ds:Signature element that contains the whole signature

baseURI:String

URI to be prepended to all relative URIs

secureValidation:boolean

whether secure secureValidation is enabled or not

provider:Provider

security provider to use

Exceptions
XMLSignatureException:
if the signature is badly formatted

Method Detail

addDocumentback to summary
public void addDocument(String referenceURI, Transforms trans, String digestURI, String referenceId, String referenceType) throws XMLSignatureException

Add a Reference with full parameters to this Signature

Parameters
referenceURI:String

URI of the resource to be signed. Can be null in which case the dereferencing is application specific. Can be "" in which it's the parent node (or parent document?). There can only be one "" in each signature.

trans:Transforms

Optional list of transformations to be done before digesting

digestURI:String

Mandatory URI of the digesting algorithm to use.

referenceId:String

Optional id attribute for this Reference

referenceType:String

Optional mimetype for the URI

addDocumentback to summary
public void addDocument(String referenceURI, Transforms trans, String digestURI) throws XMLSignatureException

This method is a proxy method for the Manifest#addDocument method.

Parameters
referenceURI:String

URI according to the XML Signature specification.

trans:Transforms

List of transformations to be applied.

digestURI:String

URI of the digest algorithm to be used.

See Also
Manifest#addDocument
addDocumentback to summary
public void addDocument(String referenceURI, Transforms trans) throws XMLSignatureException

Adds a Reference with just the URI and the transforms. This used the SHA1 algorithm as a default digest algorithm.

Parameters
referenceURI:String

URI according to the XML Signature specification.

trans:Transforms

List of transformations to be applied.

addDocumentback to summary
public void addDocument(String referenceURI) throws XMLSignatureException

Add a Reference with just this URI. It uses SHA1 by default as the digest algorithm

Parameters
referenceURI:String

URI according to the XML Signature specification.

addKeyInfoback to summary
public void addKeyInfo(X509Certificate cert) throws XMLSecurityException

Add an X509 Certificate to the KeyInfo. This will include the whole cert inside X509Data/X509Certificate tags.

Parameters
cert:X509Certificate

Certificate to be included. This should be the certificate of the key that was used to sign.

addKeyInfoback to summary
public void addKeyInfo(PublicKey pk)

Add this public key to the KeyInfo. This will include the complete key in the KeyInfo structure.

addResourceResolverback to summary
public void addResourceResolver(ResourceResolverSpi resolver)

Adds a ResourceResolverSpi to enable the retrieval of resources.

appendObjectback to summary
public void appendObject(ObjectContainer object) throws XMLSignatureException

Appends an Object (not a java.lang.Object but an Object element) to the Signature. Please note that this is only possible when signing.

Parameters
object:ObjectContainer

ds:Object to be appended.

Exceptions
XMLSignatureException:
When this object is used to verify.
checkSignatureValueback to summary
public boolean checkSignatureValue(X509Certificate cert) throws XMLSignatureException

Extracts the public key from the certificate and verifies if the signature is valid by re-digesting all References, comparing those against the stored DigestValues and then checking to see if the Signatures match on the SignedInfo.

Parameters
cert:X509Certificate

Certificate that contains the public key part of the keypair that was used to sign.

Returns:boolean

true if the signature is valid, false otherwise

checkSignatureValueback to summary
public boolean checkSignatureValue(Key pk) throws XMLSignatureException

Verifies if the signature is valid by redigesting all References, comparing those against the stored DigestValues and then checking to see if the Signatures match on the SignedInfo.

Parameters
pk:Key

java.security.PublicKey part of the keypair or javax.crypto.SecretKey that was used to sign

Returns:boolean

true if the signature is valid, false otherwise

createSecretKeyback to summary
public SecretKey createSecretKey(byte[] secretKeyBytes)

Proxy method for SignedInfo#createSecretKey(byte[]). If you want to create a MAC, this method helps you to obtain the javax.crypto.SecretKey from octets.

Returns:SecretKey

the secret key created.

See Also
SignedInfo#createSecretKey(byte[])
getBaseLocalNameback to summary
public String getBaseLocalName()

Implements abstract com.sun.org.apache.xml.internal.security.utils.ElementProxy.getBaseLocalName.

Get the local name of this element

Returns:String

Constants._TAG_SIGNATURE

Annotations
@Override
getIdback to summary
public String getId()

Returns the Id attribute

Returns:String

the Id attribute

getKeyInfoback to summary
public KeyInfo getKeyInfo()

Returns the KeyInfo child. If we are in signing mode and the KeyInfo does not exist yet, it is created on demand and added to the Signature.
This allows to add arbitrary content to the KeyInfo during signing.

Returns:KeyInfo

the KeyInfo object

getObjectItemback to summary
public ObjectContainer getObjectItem(int i)

Returns the ith ds:Object child of the signature or null if no such ds:Object element exists.

Returns:ObjectContainer

the ith ds:Object child of the signature or null if no such ds:Object element exists.

getObjectLengthback to summary
public int getObjectLength()

Returns the number of all ds:Object elements.

Returns:int

the number of all ds:Object elements.

getSignatureValueback to summary
public byte[] getSignatureValue() throws XMLSignatureException

Returns the octet value of the SignatureValue element. Throws an XMLSignatureException if it has no or wrong content.

Returns:byte[]

the value of the SignatureValue element.

Exceptions
XMLSignatureException:
If there is no content
getSignedInfoback to summary
public SignedInfo getSignedInfo()

Returns the completely parsed SignedInfo object.

Returns:SignedInfo

the completely parsed SignedInfo object.

setFollowNestedManifestsback to summary
public void setFollowNestedManifests(boolean followManifests)

Signal whether Manifest should be automatically validated. Checking the digests in References in a Signature are mandatory, but for References inside a Manifest it is application specific. This boolean is to indicate that the References inside Manifests should be validated.

See Also
Core validation section in the XML Signature Rec.
setIdback to summary
public void setId(String id)

Sets the Id attribute

Parameters
id:String

Id value for the id attribute on the Signature Element

setSignatureValueElementback to summary
private void setSignatureValueElement(byte[] bytes)

Base64 encodes and sets the bytes as the content of the SignatureValue Node.

Parameters
bytes:byte[]

bytes to be used by SignatureValue before Base64 encoding

signback to summary
public void sign(Key signingKey) throws XMLSignatureException

Digests all References in the SignedInfo, calculates the signature value and sets it in the SignatureValue Element.

Parameters
signingKey:Key

the java.security.PrivateKey or javax.crypto.SecretKey that is used to sign.