XQuery/Digital Signatures

From Wikibooks, open books for an open world
Jump to navigation Jump to search

Motivation[edit | edit source]

You want to verify that a document sent to you has not been modified.

Method[edit | edit source]

We will use the W3C Digital Signature standard. We will use the standard Java function to sign and verify the signature of a document.

Warning: This program is not working yet

Creating a Local Keystore[edit | edit source]

To use the function you will need to create a local key store to store your information in. In production systems the key store is stored on an internal server but in this example we will store it in the eXist database as a binary file.

The following shell command shows how the keytool program that comes with the Java JRE can be used to generate a keystore file:

  /usr/java/bin/keytool -genkeypair -dname "cn=Test Certificate, ou=MyDivision, o=MyCompany, c=US"
     -alias eXist -keypass kpi135 -keystore /tmp/keystore.pem -storepass ab987c -
     validity 180

After you run this file put the /tmp/keystore.pem file into your file system /db/test/dig-sig/keystore.pem

Adding a XQuery Function Wrapper Module[edit | edit source]

We will add a custom jar file to our $EXIST_HOME/lib/extensions area called x-krypt.jar. After this file has been loaded we need to add the following line to the $EXIST_HOME/conf.xml in the xquery/builtin-modules area (around line 780):

     <module class="ro.kuberam.xcrypt.XcryptModule" 
              uri="http://kuberam.ro/x-crypt" />

Adding a Digital Signature to a File[edit | edit source]

After rebooting the server the following can be executed:

xquery version "1.0";

let $keystore-file-path := '/db/test/dig-sig/keystore.txt'

return
if ( not(util:binary-doc-available($keystore-file-path)) )
   then
   <error><message>Keystore File {$keystore-file-path} Not Available</message></error>
   else

let $doc := <data><a>1</a><b>7</b><c/><c/></data>
let $certificate-details :=
    <digital-certificate>
        <keystore-type>JKS</keystore-type>
        <keystore-name>{$keystore-file-path}</keystore-name>
        <keystore-password>ab987c</keystore-password>
        <key-alias>eXist</key-alias>
        <private-key-password>kpi135</private-key-password>
    </digital-certificate>
   
let $signed-doc := x-crypt:generate-signature($doc, "inclusive", "", "DSA_SHA1", "ds", "enveloped", $certificate-details ) 

return
<results>
  <doc>{$doc}</doc>
  <keystore-file-path>{$keystore-file-path}</keystore-file-path>
</results>

Validating a Digital Signature[edit | edit source]

The same process that was used to sign an XML document can be used to verify its signature.