How to generate DigestValue and SignatureValue for enveloped XML Signature using PHP/linux tool

Question

Hi, i have been trying to find some examples on how to generate DigestValue and SignatureValue for XML signature (WSDL).

Below is a sample SOAP for the application:

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
<soapenv:Header>
<SOAP-SEC:Signature soapenv:actor="" soapenv:mustUnderstand="0">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
<ds:Reference URI="#Body">
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
<ds:DigestValue></ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue></ds:SignatureValue>
</ds:Signature>
</SOAP-SEC:Signature>
</soapenv:Header>
<soapenv:Body Id="Body">
<SomeApplicationMethod soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"&gt;
<Application href="#id0"/></SomeApplicationMethod>
<multiRef id="id0" soapenc:root="0" soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:ns1="urn:NCDServices" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xsi:type="ns1:SomeApplicationMethod">
<param2 xsi:type="soapenc:string">123456</param2>
<param3 xsi:type="soapenc:string">someString</param3>
<param4 xsi:type="soapenc:string">string123 bla bla</param4>
<param5 xsi:type="soapenc:string">0</param5>
</multiRef>
</soapenv:Body>
</soapenv:Envelope> 

I have a single example from the application provider and I cant seem to produce the same DigestValue and SignatureValue as the sample. According to the application documentation, i need to create the digestValue from the whole Body section.

I do know that i have to cannonicalize, sha1, then base64encode. But how do i cannonicalize the body section? (sha1 and base64 encode is easy enough to understand).

Initially i want to try creating a string var:

$whole_body = '<soapenv:Body Id="Body"> ........stuff inside...... </soapenv:Body>';

but then i found out that there is no such thing as c14n function in PHP (at least not for string like var, and PHP 5.2 and below; not a worry, i have 5.2.6).

I took at look at xmlseclibs.php code and it seems to use DOMelement object to get C14N function. I am not very familiar on what DOMelement is..

I tried using xmlseclibs.php to sign my XML, but it doesnt seem to work, i got 'signature not valid' error from the application.

Can someone help enlighten the newbie (reads, me :) ) ?

Thank you very much for your cooperation.

Answer 1

<?php 

$dom = new DOMDocument();  
$dom->loadXML($yourXML); // the XML you specified above.  

$canonicalized = $dom->C14N(); // for the whole document  

// .. or:  
$tag = $dom->getElementById("yourID"); // give it an ID, or use getElementsByTagName with ->item(0) or something  
$canonicalized = $tag->C14N();  

// $canonicalized is the canonicalized form of the XML   
// So, The DigestValue is just:  
$digest = base64_encode(pack("H*", sha1($canonicalized)));  
?>  

That should do your trick.

I am also busy with XML-DSIG, and wondering what pieces to canonicalize, since I received poor documentation... :(

Answer 2

Hmm.. I actually manage to get it working a while ago.

I ended up using xmlseclibs by Rob Richards. http://code.google.com/p/xmlseclibs/

I suggest you try that library, it is extremely easy to use.