How do I decide the `DigestValue`, `SignatureValue

问题:

I am working on a project where I need to verify the xml is digitally signed or not. Its really getting hard for me to try and validate the XML for the key values for following

    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
      <Reference URI=**Some URI Value**>
        <Transforms>
          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">

          </Transform>
        </Transforms>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
        <DigestValue>**Some Digest Value**</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>**Some Signature Value**</SignatureValue>
  <KeyInfo xmlns:type="http://www.w3.org/2000/09/xmldsig#RSAKeyValue">  
    <RSAKeyValue><Modulus>**Some RSA Key Value**</Modulus>  
     <Exponent>AQAB</Exponent>
    </RSAKeyValue>
   </KeyInfo >  
</Signature>

I am not able to trace out how I can get the values for

1. Reference URI
2. Digest Value
3. Signature Value
4. RSA Modulus Value

Can any one tell me how I can get the values of the all above? and what is the logic behind using these much combinations in XML Validation?

I am using C# for checking validations. you can check code for c# in my previous questions

1. How to validate XML for following code

Thanks in advance.

回答1:

If you want to just check if the values are there, just use some XML manipulation class like XDocument.

If you want to verify the signature you need to understand this:

1. The issuer generates a HASH of the document an puts on it (this is the DigestValue)
2. The issuer encrypt this HASH with his private key and puts on document (this is the SignatureValue)
3. The user sends his certificate with the document (this is the X509Certificate field).

So with you want to check if the signature is valid, you need to decript the SignatureValue with his public key and then compare it with the DigestValue. If both are equal, your document is ok, if not, maybe two things ocurred. Or the document was modified during the process, or the public key is not correspondent with the private key that encrypts the document.