ackage test.xml.signature;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.security.Key;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.EncodedKeySpec;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Collections;
import java.util.List;
import javax.xml.crypto.dom.DOMStructure;
import javax.xml.crypto.dsig.CanonicalizationMethod;
import javax.xml.crypto.dsig.DigestMethod;
import javax.xml.crypto.dsig.Reference;
import javax.xml.crypto.dsig.SignatureMethod;
import javax.xml.crypto.dsig.SignedInfo;
import javax.xml.crypto.dsig.Transform;
import javax.xml.crypto.dsig.XMLSignature;
import javax.xml.crypto.dsig.XMLSignatureFactory;
import javax.xml.crypto.dsig.dom.DOMSignContext;
import javax.xml.crypto.dsig.dom.DOMValidateContext;
import javax.xml.crypto.dsig.keyinfo.KeyInfo;
import javax.xml.crypto.dsig.keyinfo.KeyInfoFactory;
import javax.xml.crypto.dsig.keyinfo.KeyValue;
import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
import javax.xml.crypto.dsig.spec.TransformParameterSpec;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
public class SignatureXML {
public void saveKey(PublicKey publicKey, PrivateKey privateKey) throws Exception{
X509EncodedKeySpec ksp = new X509EncodedKeySpec(publicKey.getEncoded());
FileOutputStream fos = new FileOutputStream("C:\\public.key");
fos.write(ksp.getEncoded());
fos.close();
PKCS8EncodedKeySpec pks = new PKCS8EncodedKeySpec(privateKey.getEncoded());
fos = new FileOutputStream("C:\\private.key");
fos.write(pks.getEncoded());
fos.close();
}
public Key LoadKeyFromFile(boolean ispk, String keyFile) {
Key key = null;
FileInputStream is = null;
try {
is = new FileInputStream(keyFile);
byte[] buf = new byte[is.available()];
KeyFactory keyFactory = KeyFactory.getInstance("DSA");
is.read(buf);
EncodedKeySpec keySpec;
if (ispk) {
keySpec = new PKCS8EncodedKeySpec(buf);
} else {
keySpec = new X509EncodedKeySpec(buf);
}
key = (!ispk ? (Key) keyFactory.generatePublic(keySpec) : (Key) keyFactory.generatePrivate(keySpec));
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
is.close();
} catch (IOException iex) {
iex.printStackTrace();
}
}
return key;
}
public void SignatureXMLDocument(String docPath) throws Exception {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
Document doc = dbf.newDocumentBuilder().parse(new FileInputStream(docPath));
this.SignatureXMLDocument(doc);
}
public void SignatureXMLDocument(Document doc) throws Exception {
XMLSignatureFactory fac = XMLSignatureFactory.getInstance();
/*创建 <Reference> 元素，引用整个 XML 文档：
*创建 Reference 的时候将 URI 参数指定为 "" 表示对整个 XML 文档进行引用；
*摘要算法指定为 SHA1；这里将转换方式指定为 ENVELOPED ，
*这样在对整个文档进行引用并生成摘要值的时候，<Signature> 元素不会被计算在内。*/
Transform envelopedTransform = fac.newTransform(Transform.ENVELOPED,(TransformParameterSpec) null);
DigestMethod sha1DigMethod = fac.newDigestMethod(DigestMethod.SHA1, null);
Reference refToRootDoc = fac.newReference("", sha1DigMethod,Collections.singletonList(envelopedTransform), null, null);
/*创建 <SignedInfo> 元素
*因为最终的数字签名是针对 <SignedInfo> 元素而生成的，所以需要指定该 XML 元素的规范化方法，
* 以确定最终被处理的数据。这里指定为 INCLUSIVE_WITH_COMMENTS ,
* 表示在规范化 XML 内容的时候会将 XML 注释也包含在内。
* 至此，待签名的内容（<SignedInfo> 元素）已指定好，再只需要签名所使用的密钥就可以创建数字签名了。*/
CanonicalizationMethod c14nWithCommentMethod =
fac.newCanonicalizationMethod(CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS,(C14NMethodParameterSpec) null);
SignatureMethod dsa_sha1SigMethod = fac.newSignatureMethod(SignatureMethod.DSA_SHA1, null);
SignedInfo signedInfo = fac.newSignedInfo(c14nWithCommentMethod,dsa_sha1SigMethod,Collections.singletonList(refToRootDoc));
/*XML 数字签名规范规定了多种在 <KeyInfo> 中指定验证密钥的方式，比如 <KeyName>，<KeyValue>，<X509Data>，<PGPData> 等等。
* 这里使用 XML 数字签名规范规定必须实现的 <DSAKeyValue> 来指定验证签名所需的公共密钥。
* 在程序中使用 java.security 包生成 DSA 密钥对。*/
//创建密钥对
KeyPairGenerator kpGen = KeyPairGenerator.getInstance("DSA");
kpGen.initialize(512);
KeyPair keyPair = kpGen.generateKeyPair();
PublicKey publicKey = keyPair.getPublic();
PrivateKey privateKey = keyPair.getPrivate();
this.saveKey(publicKey, privateKey);
//以公钥为参数创建 <KeyValue> 元素
KeyInfoFactory keyInfoFac = fac.getKeyInfoFactory();
KeyValue keyValue = keyInfoFac.newKeyValue(publicKey);
//根据创建好的 <KeyValue> 元素创建 <KeyInfo> 元素：
KeyInfo keyInfo = keyInfoFac.newKeyInfo(Collections.singletonList(keyValue));
/*这里创建的密钥对，其中的公钥已经用于创建 <KeyInfo> 元素并存放在其中，供签名验证使用，而其中的私钥则会在下一步被用于生成签名。*/
//创建 <Signature> 元素
/*前面已经创建好 <SignedInfo> 和 <KeyInfo> 元素，为了生成最终的数字签名，
* 需要根据这两个元素先创建 <Signature> 元素，然后进行签名，
* 创建出 <SignatureValue> 元素。*/
XMLSignature signature = fac.newXMLSignature(signedInfo, keyInfo);
/*XMLSignature 类中的 sign 方法用于对文档进行签名，在调用 sign 方法之前，
* 还需要创建 DOMSignContext 对象，为方法调用提供上下文信息，
* 包括签名所使用的私钥和最后生成的 <Signature> 元素所在的目标父元素：*/
DOMSignContext dsc = new DOMSignContext(privateKey, doc.getDocumentElement());
//生成签名
/*sign 方法会生成签名值，并作为元素值创建 <SignatureValue> 元素，然后将整个 <Signature> 元素加入为待签名文档根元素的直接子元素。*/
signature.sign(dsc);
TransformerFactory tf = TransformerFactory.newInstance();
Transformer transformer = tf.newTransformer();
DOMSource source=new DOMSource(doc);
transformer.transform(source, new StreamResult(System.out));
StreamResult result = new StreamResult(new File("C:\\old.xml"));
transformer.transform(source,result);
}
private void validate(String signedFile) throws Exception {
//Parse the signed XML document to unmarshal <Signature> object.
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
Document doc = dbf.newDocumentBuilder().parse(new FileInputStream(signedFile));
this.validate(doc);
}
private void validate(Document doc) throws Exception {
// Search the Signature element
NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS,"Signature");
if (nl.getLength() == 0) {
throw new Exception("Cannot find Signature element");
}
Node signatureNode = nl.item(0);
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
XMLSignature signature = fac.unmarshalXMLSignature(new DOMStructure(signatureNode));
// Get the public key for signature validation
KeyValue keyValue = (KeyValue) signature.getKeyInfo().getContent().get(0);
PublicKey pubKey = keyValue.getPublicKey();
// Create ValidateContext
DOMValidateContext valCtx = new DOMValidateContext(pubKey,signatureNode);
// Validate the XMLSignature
boolean coreValidity = signature.validate(valCtx);
// Check core validation status
if (coreValidity == false) {
System.err.println("Core validation failed");
// Check the signature validation status
boolean sv = signature.getSignatureValue().validate(valCtx);
System.out.println("Signature validation status: " + sv);
// check the validation status of each Reference
List refs = signature.getSignedInfo().getReferences();
for (int i = 0; i < refs.size(); i++) {
Reference ref = (Reference) refs.get(i);
boolean refValid = ref.validate(valCtx);
System.out.println("Reference[" + i + "] validity status: " + refValid);
}
} else {
System.out.println("Signature passed core validation");
}
}
public static void main(String[] args) {
SignatureXML signatureXML=new SignatureXML();
try {
// signatureXML.SignatureXMLDocument("C:\\new.xml");
signatureXML.validate("C:\\old.xml");
} catch (Exception e) {
e.printStackTrace();
}
}
}