SignedXML

.NET 1.1

I have been able to do the simple examples from MSDN and such in which I just make up a generic key and then check against that.

eg.

  Dim key As New RSACryptoServiceProvider
  signer.KeyInfo = New KeyInfo
  signer.KeyInfo.AddClause(New RSAKeyValue(key))
  signer.SigningKey = key
Later I verify the sig
Dim verifier As New SignedXml(doc)
Dim myel As XmlElement 
myel = doc.GetElementsByTagName("Signature")(0) 
verifier.LoadXml(myel)
If (verifier.CheckSignature()) Then .... 
Don't I need a public key from the service recieving the message How can I make up a testing public and private key Do I need to create a certificate This is the version trying to use the certificate:
Dim cert As X509Certificates.X509Certificate
cert = cert.CreateFromCertFile("/mycert1.cer")
signer.KeyInfo = New KeyInfo
signer.KeyInfo.AddClause(New KeyInfoX509Data(cert))
'actualy generate the signature! 
Dim mykey As AsymmetricAlgorithm
mykey = mykey.Create("RSA")
signer.SigningKey = mykey

Is there a example using a public key to sign and encrypt an XML document and then to check the XML doc with a private key on the verifing side (in my case the next page). What am I missing Do I have terminology mixed up I just need to sign an xml doc and send it over an SSL connection to a receiving host. Am I making this too complicated




Answer this question

SignedXML

  • Ranjesh

    Hi Dan,

    When you do signer.KeyInfo.AddClause(new RSAKeyValue(key)), you're actually embedding the key that should be used to verify the signature right into the signature itself. That enables the verification code to work without you specifying the key. Of course, that also means anyone can just substitute their own key into the signature, modify the signed document, and then recalculate the signature -- making it seem valid to you.

    You can check out this MSDN article for information on signing and encrypting XML, and X509Certificates: http://msdn.microsoft.com/msdnmag/issues/04/11/XMLSignatures/

    -Shawn



  • SignedXML