XQuery/Digital Signatures

Motivation You want to verify that a document sent to you has not been modified. Method We will use the W3C Digital Signature standard. We will use the standard Java function to sign and verify the signature of a document. Warning: This program is not working yet Creating a Local Keystore To use the function you will need to create a local key store to store your information in. In production systems the key store is stored on an internal server but in this example we will store it in the eXist database as a binary file. The following shell command shows how the keytool program that comes with the Java JRE can be used to generate a keystore file: /usr/java/bin/keytool -genkeypair -dname "cn=Test Certificate, ou=MyDivision, o=MyCompany, c=US" -alias eXist -keypass kpi135 -keystore /tmp/keystore.pem -storepass ab987c - validity 180 After you run this file put the /tmp/keystore.pem file into your file system /db/test/dig-sig/keystore.pem Adding a XQuery Function Wrapper Module We will add a custom jar file to our $EXIST_HOME/lib/extensions area called x-krypt.jar. After this file has been loaded we need to add the following line to the $EXIST_HOME/conf.xml in the xquery/builtin-modules area (around line 780): <module class="ro.kuberam.xcrypt.XcryptModule" uri="http://kuberam.ro/x-crypt" /> Adding a Digital Signature to a File After rebooting the server the following can be executed: xquery version "1.0"; let $keystore-file-path := '/db/test/dig-sig/keystore.txt' return if ( not(util:binary-doc-available($keystore-file-path)) ) then <error><message>Keystore File {$keystore-file-path} Not Available</message></error> else let $doc := <data><a>1</a><b>7</b><c/><c/></data> let $certificate-details := <digital-certificate> <keystore-type>JKS</keystore-type> <keystore-name>{$keystore-file-path}</keystore-name> <keystore-password>ab987c</keystore-password> <key-alias>eXist</key-alias> <private-key-password>kpi135</private-key-password> </digital-certificate> let $signed-doc := x-crypt:generate-signature($doc, "inclusive", "", "DSA_SHA1", "ds", "enveloped", $certificate-details ) return <results> <doc>{$doc}</doc> <keystore-file-path>{$keystore-file-path}</keystore-file-path> </results> Validating a Digital Signature The same process that was used to sign an XML document can be used to verify its signature.