XML Signature in a Web application

Question

Hi,

We are developing an e-Banking web application for a small bank (up to 20000 clients/users). We have to implement digital signatures with X509 certificates (issued by CA on USB tokens) for signing payment information. We tried using CAPICOM but it seems that it is not working well with Windows Vista (have not tried it with Win 7). The other problem is that core banking system can process only Xml digital signatures, so we have to sign XML documents (not just a bulk-formatted text data like with CAPICOM and Win32 Crypto API).

So my questions here are:

• Does anyone of you have similar problem and how did they solved it?

• Is there a plug-in, library, component or external tool (for Internet Explorer and/or Fire Fox) that supports XML Digital Signatures in a web application?

• Can you please recommend some of these products and write something about your experience with them?

Thank you very much.

Answer 1

I used to work in an IT consulting company and in that time we used Ubi Sign ActiveX for XML Signatures in web applications from Ubisecure (www.ubisecure.com). Now I could not find any information about this product on their web site so try to email them. Also you can try this ActiveX component that I found on the internet. The name is XSign ActiveX XML Signature Component from Lizard Labs (www.lizardl.com). Didn’t tried it jet but the author says it works fine.

Answer 2

See the types in the System.Security.Cryptography.Xml namespace, especially the SignedXml class.

Answer 3

XML Signature Applet is a software component, which enables creation of XML digital signature in web applications. XML Signature Apple is a simple Java applet for doing a digital signature on a XML documents using X.509 digital certificates stored in system certificate store. This applet receives the data in a XML format and generates a enveloped signature representation in XMLDsig format.

Found it here:

http://www.digisecsolutions.com/