1
$\begingroup$

How can I use an XML detached digital signature in Java when the URI where the file is being signed will not be the same as when the file is being validated? Specifically, the file to be signed is created and signed on one server, then shipped to another server where it should be verified. The URI is file:///....

Similar to RFC 5485, the need is for the file to be signed "to be stored anywhere without hindering signature validation". Unlike RFC 5485, the need is for an XML formatted detached signature. The Java implementation seems to require the full URI to be the same at the signing time and at the validation time.

$\endgroup$
1
$\begingroup$

You do not need to include a URI in the Reference element of a detached signature. Just include the signature algorithm and the digest value, then you can associate signature and file by yourself.

| improve this answer | |
$\endgroup$
  • $\begingroup$ When I do that Java thinks it is an enveloping signature. $\endgroup$ – Jonathan Rosenne May 3 '17 at 12:58
  • $\begingroup$ An enveloping signature needs a reference URI to the enveloped element that you want to sign. $\endgroup$ – mat May 3 '17 at 13:48
  • $\begingroup$ Sorry, I meant enveloped. See oracle.com/technetwork/articles/javase/… $\endgroup$ – Jonathan Rosenne May 3 '17 at 14:17
  • $\begingroup$ That's an implementation problem. The standard allows for the Reference URI to be empty on a detached signature. But basically, the URI can be any form of identifier that you can use, it doesn't have to be a http permalink. $\endgroup$ – mat May 3 '17 at 15:58
  • $\begingroup$ I submitted a bug report against the Java API. $\endgroup$ – Jonathan Rosenne May 3 '17 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.