.Net:SignedXml - 用变换算法exc-c14n签名xml

Question

我正在尝试使用SignedXml类在C#中签名Xml(实际上是SOAP xml),签名阶段成功通过,但是当我尝试验证签名时它告诉我它无效.我在MSDN中使用XmlDsigExcC14NTransform而不是转换XmlDsigEnvelopedSignatureTransform 的示例中所做的唯一更改.如果我使用XmlDsigEnvelopedSignatureTransform,我将获得有效的签名.

这是我的签名代码:

 private static XmlDocument SignXml(XmlDocument doc)
             {
                 SignedXml signedXml = new SignedXml(doc);
                 signedXml.SigningKey = Certificate.PrivateKey;

                 Reference reference = new Reference();
                 reference.Uri = "";

                 XmlDsigEnvelopedSignatureTransform env = new XmlDsigEnvelopedSignatureTransform();
                 //XmlDsigExcC14NTransform env = new XmlDsigExcC14NTransform();

                 reference.AddTransform(env);

                 signedXml.AddReference(reference);
                 signedXml.ComputeSignature();

                 XmlElement signature = signedXml.GetXml();
                 doc.DocumentElement.AppendChild(signature);
                 doc.Save(SignedXmlPath);
                 return doc;
             }

上面的代码将给我一个有效的签名,但如果我使用

XmlDsigExcC14NTransform env = new XmlDsigExcC14NTransform();

代替

XmlDsigEnvelopedSignatureTransform env = new XmlDsigEnvelopedSignatureTransform();

我会得到一个无效的签名.

这是我的验证码:

private static bool Verify(XmlDocument doc)
        {
            SignedXml signedDoc = new SignedXml(doc);
            XmlNodeList nodeList = doc.GetElementsByTagName(Constants.SignatureElement);

            signedDoc.LoadXml((XmlElement)nodeList[0]);
            return signedDoc.CheckSignature((RSA)Certificate.PublicKey.Key);
        }

任何人都可以告诉我如何使用变换算法进行签名 http://www.w3.org/2001/10/xml-exc-c14n#

提前致谢.

Answer 1

您将需要XmlDsigEnvelopedSignatureTransform在您的情况下,因为您在要签名的元素内添加签名.

XmlDsigEnvelopedSignatureTransformSignedXml在测试签名节点的有效性之前,它将告诉类从签名节点本身删除签名.这是必需的,因为您在计算签名后添加了该元素.

您可以通过AddTransform再次调用添加多个转换,如下所示:

XmlDsigEnvelopedSignatureTransform env = new XmlDsigEnvelopedSignatureTransform();
XmlDsigExcC14NTransform c14n = new XmlDsigExcC14NTransform();

reference.AddTransform(env);
reference.AddTransform(c14n);

但是我觉得你真正想要做的不是我上面的例子,而是设置CanonicalizationMethod为c14n:

signedXml.SignedInfo.CanonicalizationMethod = "http://www.w3.org/2001/10/xml-exc-c14n#";
 - or - 
signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;