How is SOAPUI calculating the signature value withn C14E and InclusiveNamespaces?

Question

Tried to reproduce the SOAPUI Signature Calculation with php, but the signature value didn't match with the value in SOAPUI.

I'll can calculate the right digest value, but can't reproduce the sign process.

Signature value calculation includes:

Canonicalization Method: Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
Signature Method: "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
Inclusive Namespaces
Using Binary Security Token
using single certificate for signing

My two approches are:

1.approach:

canonicalize signed info include digest value
sign canonicalized string (openssl_sign)
base64 encoding the result = signature value

2. approach:

canonicalize signed info include digest value
sha1 hash canonicalized string
base64 encoding ??? maybe to much encoding
encrypt with private key
openssl_sign
base64 encoding

Something must be wrong, because with each approach I'll got different signature value back as SOAPUI it calculate. What is SOAPUI doing with the signedInfo to calculate the signature value?

Thank you very much for any constructive response.

Marcel

ced236 · Answer

Hello,&nbsp;&nbsp;I have the same problem.&nbsp;Did you solve it ?&nbsp;&nbsp;Cédric&nbsp;

nmrao · Answer

Please elaborate the problem. And are you having issue in SoapUI?

rstommel · Answer

Hi,I have the same question and would like to elaborate this in more detail:Using SoapUI I am sending a request with a Signature created by SoapUI. This Signature element contains the following SignedInfo element (copied as is from the SoapUI Raw request view):&nbsp;&lt;ds:SignedInfo&gt;&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces PrefixList="soapenv" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:CanonicalizationMethod&gt;&lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;&lt;ds:Reference URI="#otto"&gt;&lt;ds:Transforms&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces PrefixList="" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:Transform&gt;&lt;/ds:Transforms&gt;&lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;&lt;ds:DigestValue&gt;bU+yPTYXfSsBFgl16K8D2YFLLI4=&lt;/ds:DigestValue&gt;&lt;/ds:Reference&gt;&lt;/ds:SignedInfo&gt;There are now carriage returns and line feeds in there.Using Oxygen (XML Editor) this SignedInfo element is cananicalize according to http://www.w3.org/2001/10/xml-exc-c14n# resulting in the following:&lt;ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soapenv"&gt;&lt;/ec:InclusiveNamespaces&gt;&lt;/ds:CanonicalizationMethod&gt;&lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"&gt;&lt;/ds:SignatureMethod&gt;&lt;ds:Reference URI="#otto"&gt;&lt;ds:Transforms&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""&gt;&lt;/ec:InclusiveNamespaces&gt;&lt;/ds:Transform&gt;&lt;/ds:Transforms&gt;&lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/ds:DigestMethod&gt;&lt;ds:DigestValue&gt;bU+yPTYXfSsBFgl16K8D2YFLLI4=&lt;/ds:DigestValue&gt;&lt;/ds:Reference&gt;&lt;/ds:SignedInfo&gt;Before doing so I added the namespace declaration "xmlns:ds="http://www.w3.org/2000/09/xmldsig#" to the &lt;ds:SignedInfo&gt; element.&nbsp;Then I used the following OpenSSL commands to sign this SignedInfo element and to create the Base64 encoding myself in order to compare it with the one created by SoapUI (i.e. placed &lt;ds:SignatureValue&gt; of the request created by SoapUI):&nbsp;openssl dgst -sha1 -sign privkey.openssl -out soapuiSignedInfoCanon.xml.sha1 soapuiSignedInfoCanon.xmlopenssl base64 -in soapuiSignedInfoCanon.xml.sha1 -out soapuiSignedInfoCanon.xml.sha1.Base64&nbsp;Here soapuiSignedInfoCanon.xml is a file containing the canonicalized SignedInfo element. soapuiSignedInfoCanon.xml.sha1 contains the binary signature of soapuiSignedInfoCanon.xml. soapuiSignedInfoCanon.xml.sha1.Base64 is a file containing the Base64 encoded signature.&nbsp;Finally when comparing the content of soapuiSignedInfoCanon.xml.sha1.Base64 with the Base64 encoded signature created by SoapUI (i.e. found in the raw SOAP request) they differ.Using the same approach with a SignedInfo element created by Oxygen the signature created signature matches the one from Oxygen.So obviously canonicalizing the SignedInfo element created by SoapUI is not sufficient.It would therefore be good to know what the SignedInfo element looks like before it is signed by SoapUI.&nbsp;Your help is very much appreciated.&nbsp;Raph

kashiash · Answer

i have the same problem, did you found&nbsp; the solution ?

nikhil_pillai · Answer

Did you find anything regarding this issue ?
please reply if you found anything.
&nbsp;
Thank y
rstommel&nbsp;wrote:
Hi,
I have the same question and would like to elaborate this in more detail:Using SoapUI I am sending a request with a Signature created by SoapUI. This Signature element contains the following SignedInfo element (copied as is from the SoapUI Raw request view):
&nbsp;&lt;ds:SignedInfo&gt;&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces PrefixList="soapenv" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:CanonicalizationMethod&gt;&lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;&lt;ds:Reference URI="#otto"&gt;&lt;ds:Transforms&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces PrefixList="" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:Transform&gt;&lt;/ds:Transforms&gt;&lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;&lt;ds:DigestValue&gt;bU+yPTYXfSsBFgl16K8D2YFLLI4=&lt;/ds:DigestValue&gt;&lt;/ds:Reference&gt;&lt;/ds:SignedInfo&gt;
There are now carriage returns and line feeds in there.Using Oxygen (XML Editor) this SignedInfo element is cananicalize according to http://www.w3.org/2001/10/xml-exc-c14n# resulting in the following:
&lt;ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soapenv"&gt;&lt;/ec:InclusiveNamespaces&gt;&lt;/ds:CanonicalizationMethod&gt;&lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"&gt;&lt;/ds:SignatureMethod&gt;&lt;ds:Reference URI="#otto"&gt;&lt;ds:Transforms&gt;&lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;&lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""&gt;&lt;/ec:InclusiveNamespaces&gt;&lt;/ds:Transform&gt;&lt;/ds:Transforms&gt;&lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/ds:DigestMethod&gt;&lt;ds:DigestValue&gt;bU+yPTYXfSsBFgl16K8D2YFLLI4=&lt;/ds:DigestValue&gt;&lt;/ds:Reference&gt;&lt;/ds:SignedInfo&gt;
Before doing so I added the namespace declaration "xmlns:ds="http://www.w3.org/2000/09/xmldsig#" to the &lt;ds:SignedInfo&gt; element.
&nbsp;
Then I used the following OpenSSL commands to sign this SignedInfo element and to create the Base64 encoding myself in order to compare it with the one created by SoapUI (i.e. placed &lt;ds:SignatureValue&gt; of the request created by SoapUI):
&nbsp;
openssl dgst -sha1 -sign privkey.openssl -out soapuiSignedInfoCanon.xml.sha1 soapuiSignedInfoCanon.xml
openssl base64 -in soapuiSignedInfoCanon.xml.sha1 -out soapuiSignedInfoCanon.xml.sha1.Base64
&nbsp;
Here soapuiSignedInfoCanon.xml is a file containing the canonicalized SignedInfo element. soapuiSignedInfoCanon.xml.sha1 contains the binary signature of soapuiSignedInfoCanon.xml. soapuiSignedInfoCanon.xml.sha1.Base64 is a file containing the Base64 encoded signature.
&nbsp;
Finally when comparing the content of soapuiSignedInfoCanon.xml.sha1.Base64 with the Base64 encoded signature created by SoapUI (i.e. found in the raw SOAP request) they differ.
Using the same approach with a SignedInfo element created by Oxygen the signature created signature matches the one from Oxygen.
So obviously canonicalizing the SignedInfo element created by SoapUI is not sufficient.
It would therefore be good to know what the SignedInfo element looks like before it is signed by SoapUI.
&nbsp;
Your help is very much appreciated.
&nbsp;
Raph

ou

Forum Discussion

How is SOAPUI calculating the signature value withn C14E and InclusiveNamespaces?

5 Replies

Related Content

ERROR:groovy.lang.MissingMethodException: No signature of method

The signature or decryption was invalid

Can someone please explain step time calculation?

Calculate a dynamic value each test

Upload File to AWS S3 Bucket Error due to AWS Signature Problem

Recent Discussions

clone TestSuite fails when there are more project with the same name

Will SOAP UI 5.6.1 work with JDK 8

SOAP Request works in SoapUI, but not in C# code

How to configure Swagger in Paas to use it in Oracle APEX instance.

log4j1.x vulnerability