Name
xml_sign,
dsig_validate,
xenc_dsig_sign,
xenc_dsig_verify,
xenc_DSA_SHA1_sign,
xenc_DSA_SHA1_verify
— create and verify W3C XML Digital Signatures
Synopsis
any xml_sign(
|
in document any, |
| |
in template any, |
| |
in key_name varchar); |
integer dsig_validate(
|
in signed_document any, |
| |
in key_name varchar); |
varchar xenc_dsig_sign(
|
in data varchar, |
| |
in key_name varchar, |
| |
in algorithm varchar); |
integer xenc_dsig_verify(
|
in data varchar, |
| |
in signature varchar, |
| |
in key_name varchar, |
| |
in algorithm varchar); |
varchar xenc_DSA_SHA1_sign(
|
in data varchar, |
| |
in key_name varchar); |
integer xenc_DSA_SHA1_verify(
|
in data varchar, |
| |
in signature varchar, |
| |
in key_name varchar); |
Description
These BIFs implement the signing and verification side of the W3C XML
Digital Signature (XML-DSig) and XML Encryption recommendations.
xml_sign takes an XML
document, a SignedInfo
template (an XML tree describing which nodes to
canonicalise and which digest/signature methods to use) and a key name
from the server's key store, and returns the signed document with a
<Signature> element inserted per XML-DSig.
dsig_validate performs the inverse: given a signed
document it returns 1 if the signature(s) verify, 0 otherwise. When
key_name is supplied the signature is checked
against that specific key; otherwise the
<KeyInfo> in the signature itself is used.
xenc_dsig_sign and
xenc_dsig_verify are the data-level (non-XML)
counterparts: they sign / verify a raw byte buffer using the named key and
a W3C algorithm URI (e.g.
'http://www.w3.org/2000/09/xmldsig#rsa-sha1').
xenc_DSA_SHA1_sign and
xenc_DSA_SHA1_verify are convenience shortcuts
hard-coded to the DSA-SHA1 combination, useful when the algorithm is fixed
and the URI lookup is unnecessary.