Question

我测试了最终的XML签名文件并发送了“无效签名”，为什么？信息：我准备了这个inf。使用XML签名进行签名：

<?xml version="1.0" encoding="UTF-8" standalone="no"?><SolicitudRegistro
    xmlns="http://www.cie.mx/SCG/Inilidad" IdMensaje="f2-8505d81914c">
<FechaEnvio>2013-02-26T21:08:36</FechaEnvio>
<Registrante EndPoint="https://200.34.175.46:443/InteropOPE
    /MensajeidadService"  Nombre="Instigua" NombreCorto="IMTA" URI="op.mx">
<DatosDeContacto AreaOficina="Informatica" 
    CorreoElect="req@tc.ia.mx" Nombre="Rafadina" Puesto="Subdirector nicaciones" >
<Telefonos>
<Telefono Extension=" " NumeroTelefonico="7773293644" />
</Telefonos>
</DatosDeContacto>
<CertificadoInstancia>MIIFETCCA/mgAwIBAgIUMDAwMDAwMDAwMDAwMD CERTIFICATE 
    WITH SENDER'S PUBLIC KEY=</CertificadoInstancia>
</Registrante>
<Reto>
<CadenaCifrada>Ln0BAsnwrNg6IzjW7hk2c/Nxx/x3LZ STRING ENCRYPTED 
    WITH PRIVATE KEY SO RECEIVER CAN AUTHENTICATE SOURCE WITH SENDER'S CERTIFICATE=
</CadenaCifrada>
</Reto>
</SolicitudRegistro>

所以我将所有这些存储在文件results.xml中，然后我用phpseclib函数签名，代码是：

<?php
require('xmlseclibs.php');
if (file_exists('./firmas/sign-basic-test_mio.xml')) {
    unlink('./firmas/sign-basic-test_mio.xml');
}
$doc = new DOMDocument();
$doc->load('./firmas/results.xml');
$objDSig = new XMLSecurityDSig();
$objDSig->setCanonicalMethod(XMLSecurityDSig::C14N);
$objDSig->addReference($doc, XMLSecurityDSig::SHA1,
    array('http://www.w3.org/2000/09/xmldsig#enveloped-signature',
    array('http://www.w3.org/TR/1999/REC-xpath-19991116' =>
    array("query" => "ancestor-or-self::*[local-
    name()='SolicitudRegistro']"))),array("force_uri"=>true));
$objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'private'));
/* load private key */
$objKey->loadKey('i.pem', TRUE);
$objDSig->sign($objKey);
/* Add associated public key */
$objDSig->add509Cert(file_get_contents('instancia_imta_ope.crt'));
$objDSig->appendSignature($doc->documentElement);
$doc->save('./firmas/sign-basic-test_mio.xml');
$sign_output = file_get_contents('./firmas/sign-basic-test_mio.xml');
$sign_output_def = file_get_contents('./firmas/sign-basic-test_mio.res');
if ($sign_output != $sign_output_def) {
    echo "NOT THE SAME";
}
echo "DONE";
?>

这提供了一个完整的XML签名（截断一些加密文本）：

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<SolicitudRegistro xmlns="http://www.cb.mx/SCG/Interlidad"
    IdMensaje="f2e140eb-2b09-44ab-8504-87b25d81914c">
<FechaEnvio>2013-02-26T21:08:36</FechaEnvio>
<Registrante EndPoint="https://200.34.175.46:443/InteropOPE.....
<DatosDeContacto AreaOficina="Informatica" CorreoElectronico.....
<Telefonos>
<Telefono Extension=" " NumeroTelefonico="7773293644"/>
</Telefonos>
</DatosDeContacto>
<CertificadoInstancia>MIIFETCCA/mgAwIBAgIUMDAwMDY....=</CertificadoInstancia>
</Registrante>
<Reto>
<CadenaCifrada>Ln0BAsnwrNg6IzjW7hk.....</CadenaCifrada>
</Reto>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  <ds:SignedInfo><ds:CanonicalizationMethod
    Algorithm="http://ww.org/TR/2001 /REC-xml-c14n-20010315"/>
   <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
   <ds:Reference URI=""><ds:Transforms><ds:Transform Algorithm="http://www.
   w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform
   Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
  <ds:XPath>ancestor-or-self::*[local-name()='SolicitudRegistro']</ds:XPath>
  </ds:Transform></ds:Transforms><ds:DigestMethod
  Algorithm="http://www.w3.org/2000/09 /xmldsig#sha1"
  /><ds:DigestValue>GogFeLcUThvfAeyNrDBroTQaGhA=</ds:DigestValue>
 </ds:Reference>
 </ds:SignedInfo><ds:SignatureValue>N+Btck0X9H81ZUcmrIK3h7LR2CtA86BPaBFE=
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIFETCCA/mgAwIB.....=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>

所有这一个问题，你知道如何使用PHPSECLIB验证这个签名吗？或另一个图书馆？显示无效签名的测试页面是： https://ope.gob.mx/BrokerInteropQA/Diagnostico/default.aspx

感谢，我为这么多信息道歉，但我试图明白我的怀疑马里奥

Answer 1

我会使用xmlseclibs（author-blog）。现在可能正在使用openssl_* functions，但可能会重写它以使用phpseclib。

phpseclib不充分的原因是，对于XML签名，您需要XML to be canonicalized。和将以相同的方式解释，但 phpseclib 不知道这一点。对于 phpseclib ，它只是一个文本字符串，并被视为文本字符串，它们都是不同的。但是作为XML字符串处理它们不是。

Answer 2

我将以下内容与xmlseclibs一起使用，但它发送给我的是FAILURE !!!!，这可能是什么错误？

<?php
require('xmlseclibs.php');
$doc = new DOMDocument();
$arTests = array('SIGN_TEST'=>'./firmas/sign-basic-test_mio.xml');
foreach ($arTests AS $testName=>$testFile) {
    $doc->load($testFile);
    $objXMLSecDSig = new XMLSecurityDSig();
    $objDSig = $objXMLSecDSig->locateSignature($doc);
    if (! $objDSig) {
    throw new Exception("Cannot locate Signature Node");
    }
$objXMLSecDSig->canonicalizeSignedInfo();
$objXMLSecDSig->idKeys = array('wsu:Id');
$objXMLSecDSig->idNS = array('wsu'=>'http://docs.oasis-open.org/wss/2004/01/oasis- 
    200401-wss-wssecurity-utility-1.0.xsd');
$retVal = $objXMLSecDSig->validateReference();
if (! $retVal) {
    throw new Exception("Reference Validation Failed");
}
$objKey = $objXMLSecDSig->locateKey();
if (! $objKey ) {
    throw new Exception("We have no idea about the key");
}
$key = NULL;
$objKeyInfo = XMLSecEnc::staticLocateKeyInfo($objKey, $objDSig);
if (! $objKeyInfo->key && empty($key)) {
    $objKey->loadKey('i.pem', TRUE);
}
if ($objXMLSecDSig->verify($objKey)) {
    print "Signature validateddd!";
} else {
    print "Failure!!!!!!!!";
}
print "\n";
}
?>

如何在XML签名消息中使用phpseclib验证签名？

2 个答案: