Hi I have been working on adding ECDSA signature support to perl XML::Sig and I have been able to able to get the following XML::Sig signed XML to verify with:
xmlsec1 --verify --pubkey-pem t/ecdsa.public.pem --id-attr:ID "foo" ec.xml Can xmlsec1 verify an ecdsa signed file without specifying the --pubkey-pem t/ecdsa.public.pem option. Basically reading the ECKeyValue and recreating the public key similar to the method that DSA signed xml can be verified. Actually, I guess it appears that RFC 4050 compatable <dsig:KeyValue> is not supported https://github.com/lsh123/xmlsec/blob/db3d277c55d8e8c15fcdc0dad6a9d4e912c6d13d/src/openssl/evp.c#L1111 So, is there a format for ECKeyValue that is supported to validate the xml with a public key format provided in the file? The docs seem to indicate https://www.w3.org/TR/xmldsig-core1/#sec-ECKeyValue that: <ECKeyValue xmlns="http://www.w3.org/2009/xmldsig11#";> <NamedCurve URI="urn:oid:1.2.840.10045.3.1.7" /> <PublicKey> vWccUP6Jp3pcaMCGIcAh3YOev4gaa2ukOANC7Ufg Cf8KDO7AtTOsGJK7/TA8IC3vZoCy9I5oPjRhyTBulBnj7Y </PublicKey> </ECKeyValue> Is that supported? regards Tim t/ecdsa.public.pem: -----BEGIN PUBLIC KEY----- MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEs69DU1vn+KLrY1KCigCexfPMFKLVD5hc JT12cIHaJUCfkvW1VlW/fQ7xBTB6DQ1427kJ28xiumaj4T53oKPPWgVnbcsiwrvG IrFF0fX9D5AjZfpVmp8RTuF92T1FGMdM -----END PUBLIC KEY----- ec.xml: <?xml version="1.0"?> <foo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"; ID="123"><dsig:Signature> <dsig:SignedInfo xmlns:xenc="http://www.w3.org/2001/04/xmlenc#";> <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/> <dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/> <dsig:Reference URI="#123"> <dsig:Transforms> <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </dsig:Transforms> <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <dsig:DigestValue>48PJcCfbr1m88CtkExCvcDd22eQ=</dsig:DigestValue> </dsig:Reference> </dsig:SignedInfo> <dsig:SignatureValue>XsSae8/xLbVOav9JASSFzWIVL96fkxXpbYKrJICzrQ0W/1xRFMpC7oIY9c51N7J3epHgNrcRm7wl 6dpui6HG2Bl4/KH+YN5ZjfttDIyRs99dh4Dv7ih/KYSqqn0n+PFF </dsig:SignatureValue> <dsig:KeyInfo> <dsig:KeyValue> <dsig:ECKeyValue> <dsig:DomainParameters> <dsig:NamedCurve URN="urn:oid:1.3.132.0.34"/> </dsig:DomainParameters> <dsig:PublicKey> <dsig:X Value="s69DU1vn+KLrY1KCigCexfPMFKLVD5hcJT12cIHaJUCfkvW1VlW/fQ7xBTB6DQ14 "/> <dsig:Y Value="27kJ28xiumaj4T53oKPPWgVnbcsiwrvGIrFF0fX9D5AjZfpVmp8RTuF92T1FGMdM "/> </dsig:PublicKey> </dsig:ECKeyValue> </dsig:KeyValue> </dsig:KeyInfo> </dsig:Signature></foo> _______________________________________________ xmlsec mailing list [email protected] http://www.aleksey.com/mailman/listinfo/xmlsec
