Not validating signature with jsr 105

Question

Hi all.
I'm using the libraries of jsr105 xmldsig.jar and SunXmlSec-1.0.jar for signing a SAML token. I can sign the document apparently without problems but when I try to validate it in the same server that signed it simply I can't.
This is my code for creating the signature:
String providerName = System.getProperty("jsr105Provider", "org.jcp.xml.dsig.internal.dom.XMLDSigRI");
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM",(Provider) Class.forName(providerName).newInstance());
     Reference ref = fac.newReference
     ("", fac.newDigestMethod(DigestMethod.SHA1, null),
     Collections.singletonList
     (fac.newTransform
     (Transform.ENVELOPED, (TransformParameterSpec) null)),
     null, null);
     SignedInfo si = fac.newSignedInfo
     (fac.newCanonicalizationMethod
     (CanonicalizationMethod.INCLUSIVE,
     (C14NMethodParameterSpec) null),
     fac.newSignatureMethod(SignatureMethod.RSA_SHA1, null),
     Collections.singletonList(ref));
     KeyStore ks2 = KeyStore.getInstance(KeyStore.getDefaultType());
     ks2.load(new FileInputStream("C:\\KM\\keystore"), "".toCharArray());
     X509Certificate cert = (X509Certificate) pkEntry.getCertificate();
     KeyInfoFactory kif = fac.getKeyInfoFactory();
     List x509Content = new ArrayList();
     x509Content.add(cert.getSubjectX500Principal().getName());
     x509Content.add(cert);
     X509Data xd = kif.newX509Data(x509Content);
     KeyInfo ki = kif.newKeyInfo(Collections.singletonList(xd));
     DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
     dbf.setNamespaceAware(true);
     Document doc = dbf.newDocumentBuilder().parse(ad.newInputStream());
     doc.normalizeDocument();
     DOMSignContext dsc = new DOMSignContext
     (pkEntry.getPrivateKey(), doc.getDocumentElement());
     XMLSignature signature = fac.newXMLSignature(si, ki);
     dsc.setDefaultNamespacePrefix("ds");
     signature.sign(dsc);
As you can see, I have added the prefix "ds" in it. Plus, the namespace won't appear in enveloping document (saml2:assertion in my case) but in the envelope of my message.
And this is my code for validating:
OMElementImpl ghj=(OMElementImpl)XMLUtils.toOM((doc.getDocumentElement()));
assertdoc=AssertionDocument.Factory.parse(ghj.getXMLStreamReader());
assertdoc2=AssertionDocument.Factory.parse(node,options);
assertdoc3=(OMElementImpl)XMLUtils.toOM((XMLUtils.newDocument(assertdoc2.newInputStream(options)).getDocumentElement()));
asdo=AssertionDocument.Factory.parse(ghj.getXMLStreamReader());
SignatureDocument sido=SignatureDocument.Factory.newInstance();
sido.setSignature(asdo.getAssertion().getSignature());
// The code above will take the signature document from the assertion document. It's made using xmlbeans with axis2
DOMValidateContext valContext = new DOMValidateContext      (cert.getPublicKey(), sido.newDomNode());
XMLSignature signature2 = fac.unmarshalXMLSignature(valContext);
boolean coreValidity = signature2.validate(valContext);
boolean coreValidity2 = signature2.getSignatureValue().validate(valContext);
The result is that coreValidity2 is true but coreValidity is false. I don't know where the problem could be.
Could someone help me?This is very important for me. Thanks in advance.
EDIT: I have added the next code to see if references were ok as well:
Iterator i = signature.getSignedInfo().getReferences().iterator();
     for (int j=0; i.hasNext(); j++) {
     boolean refValid = ((Reference) i.next()).validate(valContext);
     throw new Exception("ref["+j+"] validity status: " + refValid);
and the validity status is true (there was only one referenc so forget about the for loop). So if references and signature are ok. How I can get a false in boolean coreValidity = signature2.validate(valContext); ?
Thank you very much for your cooperation.
Message was edited by:
the_killer_tomato

Answer 1

Hi SindhuCT,
I can't speak for PDF-XChange Viewer as to whether or not they are correctly processing the signature. The only thing I can point out is you are hashing the bytes from the beginning of the file (byte 0) to byte 569. Then you are leaving a hole for the signature from byte 570 through byte 6416. You are then hashing from byte 6417 and marching off another 400 bytes which gets you to byte 6817. Finally you are telling Acrobat/Reader to leave a hole from byte 6817 to the end of the file at byte 7830. The problem is your got byte 6817 on both sides of the fence, as part of the signed data and as part of the second unsigned portion of the file. That's probably where your problem lies.
Yes, the PDF specification does say you can include other ranges, but it also says that it's not recommended because you are not going to be checking for all changes to the document. The specification says you should sign the entire file, less the hole for the signature contents.
Steve