I am working on a C++ desktop application that reads an XML (also created by my org) from a public server (does not require authentication). I would like to make sure that the downloaded XML has not been tampered with and was created by my organization.
Digitally signing the XML before uploading it to the server should ensure both integrity and authenticity. However, I am having a hard time figuring out the approach of signing and validating the XML at the client end. So far, I have considered the following approaches:
Generate an RSA key pair using OpenSSL and use the private key to sign the XML before pushing it to the server. Embed the public key in the desktop application and use it to verify the signature of the downloaded file. The problem with this approach is that in case the private key gets compromised, generating a new key pair will break the older clients since the embedded public key won't be able to validate documents signed with the new private key.
Another option would be to embed the public key in the signed XML. This way even if the keys are changed, older clients can still work. However, now I can not be certain that the public key contained in the file is indeed mine. For eg, if someone can modify the file they can also modify the key and the signature.
To ascertain the identity of the signer I can embed a self-signed X.509 certificate in the signed XML that will contain the details of the signer along with the public key. However, I feel since the certificate is self-signed this approach also suffers from the same shortcoming as the previous approach. Getting the certificate from a CA might work but it is paid and has to be renewed periodically (1-2 years, not sure though).
It appeared to be a pretty standard problem but now I feel rather stuck at it. I would like to have a single XML file as opposed to a solution that splits the actual content and signature into different files (maybe kept on different servers).
Considering my extremely limited knowledge of signing and cryptography in general, I would appreciate if someone can help.