1
$\begingroup$

How can I use an XML detached digital signature in Java when the URI where the file is being signed will not be the same as when the file is being validated? Specifically, the file to be signed is created and signed on one server, then shipped to another server where it should be verified. The URI is file:///....

Similar to RFC 5485, the need is for the file to be signed "to be stored anywhere without hindering signature validation". Unlike RFC 5485, the need is for an XML formatted detached signature. The Java implementation seems to require the full URI to be the same at the signing time and at the validation time.

$\endgroup$

1 Answer 1

1
$\begingroup$

You do not need to include a URI in the Reference element of a detached signature. Just include the signature algorithm and the digest value, then you can associate signature and file by yourself.

$\endgroup$
5
  • $\begingroup$ When I do that Java thinks it is an enveloping signature. $\endgroup$ May 3, 2017 at 12:58
  • $\begingroup$ An enveloping signature needs a reference URI to the enveloped element that you want to sign. $\endgroup$
    – mat
    May 3, 2017 at 13:48
  • $\begingroup$ Sorry, I meant enveloped. See oracle.com/technetwork/articles/javase/… $\endgroup$ May 3, 2017 at 14:17
  • $\begingroup$ That's an implementation problem. The standard allows for the Reference URI to be empty on a detached signature. But basically, the URI can be any form of identifier that you can use, it doesn't have to be a http permalink. $\endgroup$
    – mat
    May 3, 2017 at 15:58
  • $\begingroup$ I submitted a bug report against the Java API. $\endgroup$ May 3, 2017 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.