java - XML 签名值不匹配问题

Question

我遇到 XML 签名值不匹配错误的问题。完整场景

• 我使用 OpenSSL 生成了一个 1024 位私有(private) key 。
• 我使用该私钥生成了 CSR 并将其发送到 VISA，他们已使用其根 CA 证书签署了文档，并向我发送了 .pem 格式的签名证书。
• 我使用以下 Java 代码来签署 XML 文档。

当我将数据发送回 VISA 时，他们会验证签名值并发送不匹配错误。

XMLSignatureFactory factory = XMLSignatureFactory.getInstance("DOM", (Provider) Class.forName(providerName).newInstance());

DigestMethod digestMethod = factory.newDigestMethod(DigestMethod.SHA1, null);
factory.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null);

Reference reference = factory.newReference("#" + paresId, digestMethod, null, null,null);
CanonicalizationMethod canonicalizationMethod = factory.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE, (C14NMethodParameterSpec) null);
SignatureMethod signatureMethod = factory.newSignatureMethod(SignatureMethod.RSA_SHA1, null);
SignedInfo signedInfo = factory.newSignedInfo(canonicalizationMethod, signatureMethod, Collections.singletonList(reference));

KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
kpg.initialize(512);
KeyPair keyPair = kpg.generateKeyPair();
KeyInfoFactory keyInfoFactory = factory.getKeyInfoFactory();

KeyStore keyStore = KeyStore.getInstance("JKS"); //PKC#7
keyStore.load(new FileInputStream(keystorePath), "dell12345".toCharArray());

KeyStore.PrivateKeyEntry keyEntry =
    (KeyStore.PrivateKeyEntry) keyStore.getEntry("deskey", new KeyStore.PasswordProtection("dell12345".toCharArray()));

//PrivateKey m_objRequestSigningKey = (PrivateKey) obj_keyStore.getKey(str_alias, "password".toCharArray());


KeyStore.TrustedCertificateEntry rootEntry = (KeyStore.TrustedCertificateEntry) keyStore.getEntry("root", null);
X509Certificate rootCertificate = (X509Certificate) rootEntry.getTrustedCertificate();

KeyStore.TrustedCertificateEntry intermediateEntry = (KeyStore.TrustedCertificateEntry) keyStore.getEntry("intermediate", null);
X509Certificate intermediateCertificate = (X509Certificate) intermediateEntry.getTrustedCertificate();

KeyStore.TrustedCertificateEntry signEntry = (KeyStore.TrustedCertificateEntry) keyStore.getEntry("sign", null);
X509Certificate sigingCertificate = (X509Certificate) signEntry.getTrustedCertificate(); 

List<X509Certificate> x509 = new ArrayList<X509Certificate>();
x509.add(rootCertificate );
x509.add(intermediateCertificate );
x509.add(sigingCertificate );

X509Data x509Data = keyInfoFactory.newX509Data(x509);

List<X509Data> items = new ArrayList<X509Data>();
items.add(x509Data);


KeyInfo keyInfo = keyInfoFactory.newKeyInfo(items);

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
Document doc =    dbf.newDocumentBuilder().parse(IOUtils.toInputStream(inputXml));

DOMSignContext dsc = new DOMSignContext(keyEntry.getPrivateKey(), doc.getDocumentElement());

XMLSignature signature = factory.newXMLSignature(signedInfo, keyInfo);
signature.sign(dsc);

Answer 1

抱歉，时隔很长一段时间我要回答我 5 年前发布的问题。

实际上，问题基本上出在 XML 格式上，我从 XML 中删除了下一行和回车符并将其发送回 Visa，然后我的签名正确匹配。

即使我正确提到了 CanonicalizationMethod，我也不知道为什么他们会给出错误。