Digital Signature Tools

I'm not aware that digital signature software is restricted or forbidden by law anywhere . However, the mathematics and basic algorithms for digital signatures are essentially the same as those used for some forms of cryptography. The most common signature algorithms are essentially public key cryptography algorithms run in reverse; that is, signatures are encrypted with private keys and decrypted with public keys. Consequently, the software is less available than it should be and often excessively difficult to install or configure. Vendors have to jump through hoops to be allowed to publish, sell, and export their products. The exact number of hoops varies a lot from one jurisdiction to the next . Thus, unfortunately , XML digital signature tools and libraries are somewhat sparser than they otherwise would be.

Possibly the most advanced open source library at the time of this writing is XML-Security from the Apache XML Project. This is a Java class library that runs on top of Java 1.3.1 and later. ^[1] It relies on Sun's Java Cryptography Extension for its mathematics. The preferred implementation of this API is from the Legion of the Bouncy Castle which, being based in Australia, doesn't have to submit to U.S. export laws. The Apache XML project can't legally ship the Bouncy Castle JCE with their software, but you can grab it yourself from http://www.bouncycastle.org/.

^[1] It may run on earlier versions, but the lead developer wasn't sure if it did when I asked him. Even if you can get the current version to run on a pre-1.3 VM, there's no guarantee future releases will.

XML-Security also depends on Xalan and Xerces. These products also need to be installed in your classpath. Sun ships a buggy , beta version of Xalan with Java 1.4, so if you're using Java 1.4 you'll need to put the Xalan jar archive in your jre/lib/endorsed directory rather than the jre/lib/ext directory. ^[2] Otherwise XML-Security will fail with strange error messages. Once you've done that, using this package to digitally sign DOM documents is not too difficult. Numerous samples are included with the package. However, the user interface is nonexistent.

^[2] Shortly before we went to press Sun posted a beta of Java 1.4.2 that includes a much more current version of Xalan. If you're using Java 1.4.2 or later, you're good to go.

Slightly less advanced in the API department but slightly more advanced when it comes to user interface is IBM's XSS4J. This includes a couple of sample command line applications for signing documents. First you'll need to use the keytool bundled with the JDK to create a key based on a password.

 C:> keytool -genkey -dname "CN=Elliotte Harold, OU=Metrotech,  O=Polytechnic, L=Brooklyn, S=New York, C=US"  -alias elharo -storepass mystorepassword -keypass mykeypassword 

(For various technical reasons the password can't be used as the key directly. It needs to be transformed into a more random sequence of bits.)

Next you can run the program dsig.SampleSign2 across the document to sign it.

 C:\> java dsig.SampleSign2 elharo mystorepassword mykeypassword   -ext file:///home/elharo/books/effectivexml/examples/order.xml    > signed_order.xml Key store:  file:///home/elharo/.keystore   Sign: 703ms 

This is how I produced the enveloping and detached examples earlier in this chapter. (XSS4J does not yet support enveloped signatures.) However, more commonly you'll want to integrate digital signatures into your own application, and XML-Security has a comprehensive API that allows you to do this.

There are also several commercial offerings for Java. The first is Baltimore Technologies' KeyTools XML (http://www. baltimore .com/keytools/xml/index.asp). Phaos has released a commercial XML Security Suite for Java (http:// phaos .com/products/category/xml.html) that supports XML encryption and XML digital signatures. Both of these products rely on the JCE to do the math.

Beyond Java, the pickings are very slim at this time. The only C/C++ library I've been able to locate is Infomosaic's payware SecureXML (http://www. infomosaic .net/). The System.Security.Cryptography.XML package in the .NET framework provides complete support for signing and verifying XML digital signatures. I haven't seen any libraries or tools in Perl, Python, or other languages. But this is all still pretty bleeding-edge stuff; 2004 should see many more options developed and released.