Question

Microsoft提供了一个C＃实现，但我在将其移植到Java时遇到了问题。

C＃实现： http://msdn.microsoft.com/en-us/library/windows/apps/jj649137.aspx

证书（从Microsoft下载）：

样本收据（由Microsoft提供）：

<Receipt Version="1.0" ReceiptDate="2012-08-30T23:10:05Z" CertificateId="b809e47cd0110a4db043b3f73e83acd917fe1336" ReceiptDeviceId="4e362949-acc3-fe3a-e71b-89893eb4f528">
    <AppReceipt Id="8ffa256d-eca8-712a-7cf8-cbf5522df24b" AppId="55428GreenlakeApps.CurrentAppSimulatorEventTest_z7q3q7z11crfr" PurchaseDate="2012-06-04T23:07:24Z" LicenseType="Full" />
    <ProductReceipt Id="6bbf4366-6fb2-8be8-7947-92fd5f683530" ProductId="Product1" PurchaseDate="2012-08-30T23:08:52Z" ExpirationDate="2012-09-02T23:08:49Z" ProductType="Durable" AppId="55428GreenlakeApps.CurrentAppSimulatorEventTest_z7q3q7z11crfr" />
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
            <Reference URI="">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                <DigestValue>cdiU06eD8X/w1aGCHeaGCG9w/kWZ8I099rw4mmPpvdU=</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>SjRIxS/2r2P6ZdgaR9bwUSa6ZItYYFpKLJZrnAa3zkMylbiWjh9oZGGng2p6/gtBHC2dSTZlLbqnysJjl7mQp/A3wKaIkzjyRXv3kxoVaSV0pkqiPt04cIfFTP0JZkE5QD/vYxiWjeyGp1dThEM2RV811sRWvmEs/hHhVxb32e8xCLtpALYx3a9lW51zRJJN0eNdPAvNoiCJlnogAoTToUQLHs72I1dECnSbeNPXiG7klpy5boKKMCZfnVXXkneWvVFtAA1h2sB7ll40LEHO4oYN6VzD+uKd76QOgGmsu9iGVyRvvmMtahvtL1/pxoxsTRedhKq6zrzCfT8qfh3C1w==</SignatureValue>
    </Signature>
</Receipt>

Java实现：

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
Document doc = dbf.newDocumentBuilder().parse(new FileInputStream("/XMLFile1.xml"));

NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
if (nl.getLength() == 0) {
    throw new Exception("Cannot find Signature element");
}

String base64CertString = "MIIDyTCCArG...   // Copied from certificate without new lines and -- BEGIN .. END stuff ...
byte  data[] = Base64.decodeBase64(base64CertString);
CertificateFactory f = CertificateFactory.getInstance("X.509");
X509Certificate certificate = (X509Certificate) f.generateCertificate( new ByteArrayInputStream(data));

certificate.checkValidity(); // Validates OK!

PublicKey pk = certificate.getPublicKey();          

// document containing the XMLSignature
DOMValidateContext valContext = new DOMValidateContext(pk, nl.item(0));

String providerName = System.getProperty("jsr105Provider", "org.jcp.xml.dsig.internal.dom.XMLDSigRI");
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM", (Provider) Class.forName(providerName).newInstance());

XMLSignature signature = fac.unmarshalXMLSignature(valContext);
boolean valid = signature.validate(valContext);

// Check core validation status
if (valid == false) {
    System.out.println("Signature failed core validation");
    boolean sv = signature.getSignatureValue().validate(valContext);
    System.out.println("signature validation status: " + sv);
    // check the validation status of each Reference
    @SuppressWarnings("rawtypes")
    Iterator i = signature.getSignedInfo().getReferences().iterator();
    for (int j=0; i.hasNext(); j++) {
        boolean refValid = ((Reference) i.next()).validate(valContext);
        System.out.println("ref["+j+"] validity status: " + refValid);
    }            
} else {
    System.out.println("Signature passed core validation");
}

验证在签名验证和参考验证中均失败。为什么？

Answer 1

如果您使用java检查收据，则应删除字符“＆gt;”之间的空格和“＆lt;”，那么你就会成功

Answer 2

我通过使用以下代码修剪xml的每一行来实现它：

private static String trim(String input) {
    BufferedReader reader = new BufferedReader(new StringReader(input));
    StringBuilder result = new StringBuilder();

    try {
        String line;
        while ((line = reader.readLine()) != null) {
            result.append(line.trim());
        }

        return result.toString();
    } catch (IOException e) {
        throw new RuntimeException(e);
    }
}

Windows应用商店 - 使用Java验证收据

2 个答案: