XML Signing

[Nak]

Hi there,

I have been taking a look at a microsoft example for enveloping XML
files. What I would like to use an "enveloped XML" file for is a custom
license file. I am just slightly confused as to how I verify *who* has
actually signed to file, rather than if it is signed or not.

For example, if I create license files I would like the application to
verify that they came from me, and were signed with my key, rather than
someone else making license files. This *is* possible isn't it? This is
the very last part of my application that needs completing so I'm keen to
get this right, any advice would be most appreciated!

Nick.

[Kevin Yu [MSFT]]

Hi Nak,

First of all, I would like to confirm my understanding of your issue. From
your description, I understand that you need to verify the signature of Xml
signing. If there is any misunderstandin g, please feel free to let me know.

Based on my research, CAPICOM has provided us with methods to sign and
verify xml documents. First we use private key to sign the document and
when we receive it, we use verify method and public key to verify if the
document is signed by certain person.

For more information, please check the following links:

http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_sign.asp
http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_verify.as p

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Nak]

Hi Kevin,

This is *exactly* what I was after, thank you most kindly!

Nick.

"Kevin Yu [MSFT]" <v-****@online.mic rosoft.com> wrote in message
news:Vc******** ******@cpmsftng xa10.phx.gbl...

Hi Nak,

First of all, I would like to confirm my understanding of your issue. From
your description, I understand that you need to verify the signature of
Xml
signing. If there is any misunderstandin g, please feel free to let me
know.

Based on my research, CAPICOM has provided us with methods to sign and
verify xml documents. First we use private key to sign the document and
when we receive it, we use verify method and public key to verify if the
document is signed by certain person.

For more information, please check the following links:

http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_sign.asp
http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_verify.as p

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Nak]

Hi again Kevin,

On previous occasions I have created a key pair using the .NET Framework
Cryptography namespace,

Imports System.IO
Imports System.Security .Cryptography
Imports System.text

Public Function rsaCreateKeysFi les(ByVal iPrivateKeyFile As String, ByVal
iPublicKeyFile As String) As Boolean
Dim pFSmOutput As FileStream
Try
Dim pCPsParams As New CspParameters()
pCPsParams.Flag s = CspProviderFlag s.UseMachineKey Store
Dim pCSPRSA As New
System.Security .Cryptography.R SACryptoService Provider(pCPsPa rams)
Dim pStrData As String

pFSmOutput = New FileStream(iPri vateKeyFile, FileMode.Create )
pStrData = pCSPRSA.ToXmlSt ring(True)
pFSmOutput.Writ e(Encoding.ASCI I.GetBytes(pStr Data), 0,
pStrData.Length )
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()

pFSmOutput = New FileStream(iPub licKeyFile, FileMode.Create )
pStrData = pCSPRSA.ToXmlSt ring(False)
pFSmOutput.Writ e(Encoding.ASCI I.GetBytes(pStr Data), 0,
pStrData.Length )
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()
Return (True)
Catch ex As Exception
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()
Throw (ex)
End Try
End Function

This function will create a public and a private key file at the paths
specified in the parameters iPrivateKeyFile and iPublicKeyFile. Is it
possible for me to use these keys using the API that you have referred me
onto. I presume that I have to use the createKeyFromCS P method, or do I
actually have to create the keys using this API also? Cheers again, much
appreciation in your direction.

Nick.

"Nak" <[e-mail]> wrote in message
news:eB******** *******@TK2MSFT NGP09.phx.gbl.. .

Hi Kevin,

This is *exactly* what I was after, thank you most kindly!

Nick.

"Kevin Yu [MSFT]" <v-****@online.mic rosoft.com> wrote in message
news:Vc******** ******@cpmsftng xa10.phx.gbl...

Hi Nak,

First of all, I would like to confirm my understanding of your issue.
From
your description, I understand that you need to verify the signature of
Xml
signing. If there is any misunderstandin g, please feel free to let me
know.

Based on my research, CAPICOM has provided us with methods to sign and
verify xml documents. First we use private key to sign the document and
when we receive it, we use verify method and public key to verify if the
document is signed by certain person.

For more information, please check the following links:

http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_sign.asp
http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_verify.as p

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Nak]

Hello yet again,

Can XML verification and signing be performed through the SignedXML
class?

Nick.

"Nak" <[e-mail]> wrote in message
news:%2******** ********@tk2msf tngp13.phx.gbl. ..

Hi again Kevin,

On previous occasions I have created a key pair using the .NET
Framework Cryptography namespace,

Imports System.IO
Imports System.Security .Cryptography
Imports System.text

Public Function rsaCreateKeysFi les(ByVal iPrivateKeyFile As String, ByVal
iPublicKeyFile As String) As Boolean
Dim pFSmOutput As FileStream
Try
Dim pCPsParams As New CspParameters()
pCPsParams.Flag s = CspProviderFlag s.UseMachineKey Store
Dim pCSPRSA As New
System.Security .Cryptography.R SACryptoService Provider(pCPsPa rams)
Dim pStrData As String

pFSmOutput = New FileStream(iPri vateKeyFile, FileMode.Create )
pStrData = pCSPRSA.ToXmlSt ring(True)
pFSmOutput.Writ e(Encoding.ASCI I.GetBytes(pStr Data), 0,
pStrData.Length )
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()

pFSmOutput = New FileStream(iPub licKeyFile, FileMode.Create )
pStrData = pCSPRSA.ToXmlSt ring(False)
pFSmOutput.Writ e(Encoding.ASCI I.GetBytes(pStr Data), 0,
pStrData.Length )
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()
Return (True)
Catch ex As Exception
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()
Throw (ex)
End Try
End Function

This function will create a public and a private key file at the paths
specified in the parameters iPrivateKeyFile and iPublicKeyFile. Is it
possible for me to use these keys using the API that you have referred me
onto. I presume that I have to use the createKeyFromCS P method, or do I
actually have to create the keys using this API also? Cheers again, much
appreciation in your direction.

Nick.

"Nak" <[e-mail]> wrote in message
news:eB******** *******@TK2MSFT NGP09.phx.gbl.. .

Hi Kevin,

This is *exactly* what I was after, thank you most kindly!

Nick.

"Kevin Yu [MSFT]" <v-****@online.mic rosoft.com> wrote in message
news:Vc******** ******@cpmsftng xa10.phx.gbl...

Hi Nak,

First of all, I would like to confirm my understanding of your issue.
From
your description, I understand that you need to verify the signature of
Xml
signing. If there is any misunderstandin g, please feel free to let me
know.

Based on my research, CAPICOM has provided us with methods to sign and
verify xml documents. First we use private key to sign the document and
when we receive it, we use verify method and public key to verify if the
document is signed by certain person.

For more information, please check the following links:

http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_sign.asp
http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_verify.as p

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Nak]

All done, using the SignedXML class, thanks for your help Kevin.

Nick.

"Nak" <[e-mail]> wrote in message
news:ul******** ******@TK2MSFTN GP12.phx.gbl...

Hello yet again,

Can XML verification and signing be performed through the SignedXML
class?

Nick.

"Nak" <[e-mail]> wrote in message
news:%2******** ********@tk2msf tngp13.phx.gbl. ..

Hi again Kevin,

On previous occasions I have created a key pair using the .NET
Framework Cryptography namespace,

Imports System.IO
Imports System.Security .Cryptography
Imports System.text

Public Function rsaCreateKeysFi les(ByVal iPrivateKeyFile As String, ByVal
iPublicKeyFile As String) As Boolean
Dim pFSmOutput As FileStream
Try
Dim pCPsParams As New CspParameters()
pCPsParams.Flag s = CspProviderFlag s.UseMachineKey Store
Dim pCSPRSA As New
System.Security .Cryptography.R SACryptoService Provider(pCPsPa rams)
Dim pStrData As String

pFSmOutput = New FileStream(iPri vateKeyFile, FileMode.Create )
pStrData = pCSPRSA.ToXmlSt ring(True)
pFSmOutput.Writ e(Encoding.ASCI I.GetBytes(pStr Data), 0,
pStrData.Length )
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()

pFSmOutput = New FileStream(iPub licKeyFile, FileMode.Create )
pStrData = pCSPRSA.ToXmlSt ring(False)
pFSmOutput.Writ e(Encoding.ASCI I.GetBytes(pStr Data), 0,
pStrData.Length )
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()
Return (True)
Catch ex As Exception
Call pFSmOutput.Flus h()
Call pFSmOutput.Clos e()
Throw (ex)
End Try
End Function

This function will create a public and a private key file at the paths
specified in the parameters iPrivateKeyFile and iPublicKeyFile. Is it
possible for me to use these keys using the API that you have referred me
onto. I presume that I have to use the createKeyFromCS P method, or do I
actually have to create the keys using this API also? Cheers again, much
appreciation in your direction.

Nick.

"Nak" <[e-mail]> wrote in message
news:eB******** *******@TK2MSFT NGP09.phx.gbl.. .

Hi Kevin,

This is *exactly* what I was after, thank you most kindly!

Nick.

"Kevin Yu [MSFT]" <v-****@online.mic rosoft.com> wrote in message
news:Vc******** ******@cpmsftng xa10.phx.gbl...
Hi Nak,

First of all, I would like to confirm my understanding of your issue.
From
your description, I understand that you need to verify the signature of
Xml
signing. If there is any misunderstandin g, please feel free to let me
know.

Based on my research, CAPICOM has provided us with methods to sign and
verify xml documents. First we use private key to sign the document and
when we receive it, we use verify method and public key to verify if
the
document is signed by certain person.

For more information, please check the following links:

http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_sign.asp
http://msdn.microsoft.com/library/de...us/xmlsdk/html
/xmmth_verify.as p

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."