Signing XML and Canonicalization

Question

I am trying to digitally sign some xml and am having a hard time understanding the canonicalization options. The code I'm using is derived from the examples at the bottom of:
http://java.sun.com/javase/6/docs/technotes/guides/security/xmldsig/overview.html
I am creating an "enveloped" signature. Here is the relevant code from the GenEnveloped example:
        // Create a DOM XMLSignatureFactory that will be used to generate the
        // enveloped signature
        XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
        // Create a Reference to the enveloped document (in this case we are
        // signing the whole document, so a URI of "" signifies that) and
        // also specify the SHA1 digest algorithm and the ENVELOPED Transform.
        Reference ref = fac.newReference("", fac.newDigestMethod(DigestMethod.SHA1, null),
                                         Collections.singletonList(fac.newTransform(Transform.ENVELOPED,
                                                                                    (TransformParameterSpec)
                                                                                    null)),
                                         null, null);
        // Create the SignedInfo
        SignedInfo si = fac.newSignedInfo(fac.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE,
                                                                        (C14NMethodParameterSpec)
                                                                        null),
                                          fac.newSignatureMethod(SignatureMethod.DSA_SHA1, null),
                                          Collections.singletonList(ref));I would like the canonicalization method to ignore whitespace outside of xml elements. Thus, the addition of a blank line wouldn't change the signature. None of the standard options to newCanonicalizationMethod() [INCLUSIVE, INCLUSIVE_WITH_COMMENTS, EXCLUSIVE, EXCLUSIVE_WITH_COMMENTS] do this. Is it possible? This seems like a reasonable thing to do so I'm surprised it is not more obvious.

Answer 1

Hi,
I've implemented EnvelopingSignature XAdES mechanism based on the GenEnveloping.java sample. I have 2 references (one refer to the data and the other to Signature properties). I implemented the inclusive transform for these 2 references and the signed info. and it worked (signature ok, validation ok). the problem now is that i have to apply the inclusive transform only for the first reference and the exclusive one for the rest. So, i simply replaced the CanonicalizationMethod.INCLUSIVE attribute of the second reference and signedinfo by the attribute EXCLUSIVE and got the error below:
java.lang.NullPointerException
     at org.jcp.xml.dsig.internal.dom.DOMExcC14NMethod.marshalParams(DOMExcC14NMethod.java:88)
Here is my implementation:
String mh = DigestMethod.SHA1;
String ms = SignatureMethod.RSA_SHA1;
Transform trf = fac.newTransform(CanonicalizationMethod.INCLUSIVE,(TransformParameterSpec)null);
Transform trfEXC = fac.newTransform(CanonicalizationMethod.EXCLUSIVE,(TransformParameterSpec)null);
List refs = new ArrayList();
ref1 = fac.newReference("#Data",fac.newDigestMethod(mh, null), Collections.singletonList(trf), null, "Data-Ref");
refs.add(ref1);
ref2 = fac.newReference("#"+signedPropID, fac.newDigestMethod(mh,null),Collections.singletonList(trfEXC),"http://uri.etsi.org/01903/#SignedProperties", "SignedProperties-Ref");
refs.add(ref2);
SignedInfo si = fac.newSignedInfo(fac.newCanonicalizationMethod(CanonicalizationMethod.EXCLUSIVE, (C14NMethodParameterSpec)null),fac.newSignatureMethod(ms, null),refs);Any help would be appreciated..
Thx