1
$\begingroup$

How can I use an XML detached digital signature in Java when the URI where the file is being signed will not be the same as when the file is being validated? Specifically, the file to be signed is created and signed on one server, then shipped to another server where it should be verified. The URI is file:///....

Similar to RFC 5485, the need is for the file to be signed "to be stored anywhere without hindering signature validation". Unlike RFC 5485, the need is for an XML formatted detached signature. The Java implementation seems to require the full URI to be the same at the signing time and at the validation time.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

You do not need to include a URI in the Reference element of a detached signature. Just include the signature algorithm and the digest value, then you can associate signature and file by yourself.

Improve this answer
$\endgroup$
5
  • $\begingroup$ When I do that Java thinks it is an enveloping signature. $\endgroup$
    – Jonathan Rosenne
    Commented May 3, 2017 at 12:58
  • $\begingroup$ An enveloping signature needs a reference URI to the enveloped element that you want to sign. $\endgroup$
    – mat
    Commented May 3, 2017 at 13:48
  • $\begingroup$ Sorry, I meant enveloped. See oracle.com/technetwork/articles/javase/… $\endgroup$
    – Jonathan Rosenne
    Commented May 3, 2017 at 14:17
  • $\begingroup$ That's an implementation problem. The standard allows for the Reference URI to be empty on a detached signature. But basically, the URI can be any form of identifier that you can use, it doesn't have to be a http permalink. $\endgroup$
    – mat
    Commented May 3, 2017 at 15:58
  • $\begingroup$ I submitted a bug report against the Java API. $\endgroup$
    – Jonathan Rosenne
    Commented May 3, 2017 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.