Error validation about xml-crypto

[yaronn]

where is the xml?

[Gustavinho]

I attached you the xml and the public key
JAEP820923NM9-AOPF580423BIA.txt
JAEP820923NM9_publicKey.key.pem.txt

[yaronn]

this xml already contains a signature, why do you sign it again? try all of this on a very simple xml (1-2 tags) to see if it works on that.

[Gustavinho]

I'm trying with hello and
sign = new SignedXml()
sign.addReference "//*[local-name(.)='node']" , "" , "" , "" , "" , "" , true

but it doesn't work

[Gustavinho]

sorry , the xml I'm using now is from attached image

[yaronn]

try this using null instead of empty strings in addReference.

[Gustavinho]

I tried with null instead empty strings, but I had the same result
sign.addReference "//*[local-name(.)='node']" , null , null , null , null , null , true

[yaronn]

does it work if you just give addReference the first parameter (I know it will create the wrong URI but lets see if at least it gets the signature correctly).

[yaronn]

if it fails try the example file or readme sample of the project. if it works try to hard code here to use the empty uri value:

https://github.com/yaronn/xml-crypto/blob/master/lib/signed-xml.js#L560

[bjrmatos]

the problem is that you must sign your xml with the enveloped signature transform (because the signature will live inside the node you are signing)

[bjrmatos]

try using:

(example in js)

sign.addReference(
    "//*[local-name(.)='ConsultaSectorPrimario']",
    [
      'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
      'http://www.w3.org/2001/10/xml-exc-c14n#'
    ],
    null,
    '',
    '',
    '',
    true
);

[bjrmatos]

that should work.. if it doesn't work please create a repository with your original xml, a dumb private/public key and the code you are using.

[yaronn]

good call @bjrmatos!

[Gustavinho]

woooooow, that it works, good one @bjrmatos, thanks, now I'm getting a successful validate, the web validator https://www.aleksey.com/xmlsec/xmldsig-verifier.html still says "invalid signature" but it doesn't care, thaks so much

[Gustavinho]

I have a question, can I sign a xml twice? I mean a second sign to a xml previously signed and includes both signs

first xml to sign

second xml to sign

[bjrmatos]

mmm technically, you can (i'm sure xml-crypto let you do that) but i don't know if it is valid according to the XML Digital Signature Spec, i haven't seen a xml with a re-signature but maybe @yaronn know more about this

[Gustavinho]

I don't think it'll be valid to the standard, but is a requirement of electronical invoice in México, I tried to do it but the first and the second sign has the same digestvalue always, I don't know if it'll be ok

[bjrmatos]

i'm closing this because is not an issue, feel free to keep comment.

mmm interesting, i have implemented electronical invoice in Perú.. in that case there is no need for re-sign the document. if i understand correctly mexico (and other countries in south america) use the UBL standard for electronical invoices, is that correct?

[Gustavinho]

Peru uses the UBL standard, but Mexico don't, Mexico has own standard, and it has many different process, one of them requires a resigned xml, and I just read that also requires a canonicalization method 1.1, I don't know if xml-crypto supports this method

[bjrmatos]

xml-crypto support canonicalization methods and extending with custom canonicalization methods, but i don't know how the canonicalization 1.1 works (maybe is just one of the supported canonicalization methods that xml-crypto have but with other name).

I don't think it'll be valid to the standard, but is a requirement of electronical invoice in México, I tried to do it but the first and the second sign has the same digestvalue always, I don't know if it'll be ok

if you create a repository, i can help you to test the re-sign to a document. unfortunately i don't know coffeescript so you should create the repository in JavaScript (it is short code anyway)

[Gustavinho]

Thanks so much, I'll create a repository in javascript, and now I have an exact example with the xml signes an resigned, I'll also add it to repository