0

I have a c# app which I use to process encrypted and signed xml file from a 3rd party. File I generate and sign inside the app using valid certificate pass the validation without problems. I have problems validating files received from the 3rd party. (which is a reputable source so I rule out problems on their end)

File is successfully decrypted but signature validation always returns false. I have tried to strip off their signature and signing the file myself - I have generated the same <DigestValue> and apart from differences in binary fields (as expected using different certificates), files structures are identical

I load the .pem file to X509Certificate2 object and try to validate the received file. It has all necessary elements but the validation always fails without any indication why.

Is there anything else I need to do? Any good resource to understand what CheckSignature() does?

The signature validation code (working on self signed files)

public static bool VerifySignedXml(string signedXmlPath, X509Certificate2 theirPublicKey)
    {
        XmlDocument doc = new XmlDocument();
        doc.Load(signedXmlPath);

        XmlElement signature = (XmlElement)doc.GetElementsByTagName("Signature")[0];

        SignedXml sig = new SignedXml(doc);
        sig.LoadXml(signature);

        bool bVerified = sig.CheckSignature(theirPublicKey , false);

        return bVerified;
    }

Thanks

user3218782
  • 111
  • 2
  • 7
  • What happens when you call `sig.CheckSignature(theirPublicKey, true);`? This will only validate integrity of the signed document (meaning it has not been tampered with). I suspect that the problem is with the validation of the certificate. – pepo Apr 26 '17 at 12:15
  • Thanks pepo, it's the same it returns false – user3218782 Apr 26 '17 at 12:43
  • What signature algorithm is being used? A few years back I was using [CLR Security](http://clrsecurity.codeplex.com/) to handle RSA-SHA256 algorithm because dotnet did not now about this algorithm in xml signatures. – pepo Apr 26 '17 at 13:25
  • [This answer](http://stackoverflow.com/questions/19620970/sha256-signing-stops-working-in-net-4-5) might help you – pepo Apr 26 '17 at 13:28
  • Thanks pepo, Signature Alg is sha256RSA, Signature hash alg is sha256 and thumbprint alg is sha1, I compared the working one with the one I have problems with and all the algs are the same. Reading the answer you linked now, thanks. – user3218782 Apr 26 '17 at 14:06

0 Answers0