Class XMLDSigToken
Build or analyze an XML token.
An XML token is an enveloping XML Digital Signature (cf. RFC 3275) containing signed and timestamped user data. These data may also be encrypted. In this case we talk about Secure XML token.
This class uses the following default algorithms to operate:
Algorithm used to canonalize data before signing is: http://www.w3.org/TR/2001/REC-xml-c14n-20010315.
Algorithm used to generate the signature is: http://www.w3.org/2000/09/xmldsig#rsa-sha1.
Algorithm used to compute the hash of token data is: http://www.w3.org/2000/09/xmldsig#sha1.
Algorithm used to encode data's values is: Base64.
An XML token looks like this:
<?xml version="1.0"?> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> <ds:Reference URI="#Token"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <ds:DigestValue>---- TOKEN HASH ----</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>---- SIGNATURE VALUE ----</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>---- X.509 CERTIFICATE ----</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> <ds:Object Id="Token"> <Token> <TokenTimestamp>2016-10-24T08:33:14Z</TokenTimestamp> <TokenData> <data1 Algorithm="base64">---- BASE64 ENCODED DATA ----</data1> <data2 Algorithm="base64">---- BASE64 ENCODED DATA ----</data2> <data3> <data31 Algorithm="base64">---- BASE64 ENCODED DATA ----</data31> <data32 Algorithm="base64">---- BASE64 ENCODED DATA ----</data32> </data3> <data4 Algorithm="base64">---- BASE64 ENCODED DATA ----</data4> </TokenData> </Token> </ds:Object> </ds:Signature>
The signing process consists in the following actions:
Load data from an associative array.
Encode data values using Base64.
Build a node from the encoded array of data (cf. node
<TokenData />
).Compute an UTC timestamp and store it in a node
<TokenTimestamp />
.Aggregate the nodes
<TokenTimestamp />
and<TokenData />
inside a node<Token />
.Load the base DOM document representing an XML digital signature:
<ds:Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:SignatureMethod />
</ds:SignedInfo>
</ds:Signature>
Create a node
<ds:Object Id="Token" />
and append it to the node<ds:Signature />
.Add the node
<Token />
to the node<ds:Object Id="Token" />
.NOTE : If data encryption is requested, this process will take place here (this will be described later).
Build a node
<ds:Reference URI="#Token" />
and append it to the node<ds:SignedInfo />
. This consists in:- Canonicalizing the content of the node
<ds:Object Id="Token" />
. - Computing the SHA1 hash of the canonicalized node and storing it in the node
<ds:DigestValue />
.
- Canonicalizing the content of the node
Includes, in the the XML token, the X.509 certificate associated to the private key that will be used to perform the signing (see the next steps below). This cerficate will be used to perform the signature validation process, avoiding the need, for the receiver of the XML Digital Signature to own it on its side.
Canonicalize the content of the node
<ds:SignedInfo />
.Compute the signature of the canonicalized node using the private key dedicated to perform signing.
Store the result in the node
<ds:SignatureValue />
.Save the DOM document in XML format.
The signature validation process consist in the following actions:
Load the XML Digital Singature in a DOM document.
Compute the SHA1 hash of the content of the node
<ds:Object Id="Token" />
.Compare the computed hash with the one stored in the node
<ds:DigestValue />
. If the hash are different, this means that the content of the node<ds:Object Id="Token" />
has been altered.Canonicalize the content of the node
<ds:SignedInfo />
.Compute the signature of the node
<ds:SignedInfo />
using the X.509 certificate included in the XML token.Compare the computed signature with the one stored in the node
<ds:SignatureValue>
. If the signatures are different, this means that content the node<ds:SignedInfo />
has not been signed using the private key associated to the X.509 certificate included in the XML Digital Signature.NOTE: If data decryption is required, this process will take place here (this will be described later).
Extract the timestamp stored in the content of the node
<ds:Object Id="Token" />
and memorise it.Extract the data stored in the content of the node
<ds:Object Id="Token" />
.Decode data values using Base64.
Buid an associative array containing the decoded data.
Token data encryption / decryption:
The token data may also be encrypted before signing. In this case the class will use the following default algorithms to perform encryption and decryption of data:
Algorithm used to encrypt / decrypt data is: http://www.w3.org/2001/04/xmlenc#aes128-cbc (symetric ciphering).
Algorithm used to encrypt / decrypt the session key is: http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p (asymetric ciphering).
A secure (crypted) XML token looks like this:
<?xml version="1.0"?> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> <ds:Reference URI="#Token"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <ds:DigestValue>---- TOKEN HASH ----</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>---- SIGNATURE VALUE ----</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>---- X.509 CERTIFICATE ----</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> <ds:Object Id="Token"> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Content"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/> <ds:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedKey> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/> <xenc:CipherData> <xenc:CipherValue>---- CIPHERED SESSION KEY ----</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>---- ENCRYPTED DATA ----</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </ds:Object> </ds:Signature>
The encryption process is the following:
Randomly generate a session key.
Cipher the session key using the X.509 certificate dedicated to the encryption process, in order to transmit it safely in the XML Digital Signature.
Store the ciphered session key in the node
<xenc:CipherValue />
which is located inside the node<xenc:EncryptedKey />
.Encrypt the content of the node
<ds:Object Id="Token" />
using the non-ciphered session key and store the result in the last node<xenc:CipherValue />
.
The decryption process is the following:
Retrieve the node
<xenc:EncryptedData />
.Decipher the ciphered session key stored in the node
<xenc:CipherValue />
(the one which is located inside the node<xenc:EncryptedKey />
) using the private key associated to the X.509 certificate that has been used to perform the encryption.Decrypt the content of the last node
<xenc:CipherValue />
using the deciphered session key.
Copyright: 2017 - Thierry Thiers webcoder31@gmail.com
License: CeCILL-C License
Author: Thierry Thiers webcoder31@gmail.com
Located at XMLDSigToken.php
public
|
#
__debugInfo( )
Defines a custom output for |
protected
|
#
__construct( mixed $xmlOrData, string $signKeyPath = null, string $signKeyPassword = null, string $signCertPath = null, string $cryptKeyPath = null, string $cryptKeyPassword = null, string $cryptCertPath = null, array $options = [] )
Instantiate an XMLDSigToken object. |
public static
|
#
createXMLToken( array $data, string $signKeyPath, string $signCertPath, string $signKeyPassword = null, array $options = [] )
Creates an XML token for the given user data. |
public static
|
#
createSecureXMLToken( array $data, string $signKeyPath, string $signCertPath, string $cryptKeyPath, string $cryptCertPath, string $signKeyPassword = null, string $cryptKeyPassword = null, array $options = [] )
Creates a secure (crypted) XML token for the given user data. |
public static
|
|
public static
|
#
analyzeSecureXMLToken( string $xml, string $cryptKeyPath, string $cryptKeyPassword = null, array $options = [] )
Parse an XML token whose data are crypted. |
public
boolean
|
|
public
boolean
|
#
isOutOfDate( integer $ttl = self::TOKEN_DEFAULT_TTL )
Indicates whether the XML token is out of date or not. |
public
boolean
|
|
public
boolean|null
|
#
isDigestValueOk( )
Indicates whether the digest of token data (a hash) has been verified and is valid or not. |
public
boolean|null
|
#
isSignatureValueOk( )
Indicates whether signature of the digest of the token data has been verified and is valid or not. |
public
string|null
|
|
public
array|null
|
|
public
string|null
|
|
public
string|null
|
|
public
array|null
|
|
public
string|null
|
|
public
array|null
|
#
getCertIssuer( )
Get the issuer information of the X.509 certificate that is included in the XML token. |
public
array|null
|
#
getCertSubject( )
Get the subject information of the X.509 certificate that is included in the XML token. |
public
string|null
|
|
public
string|null|false
|
#
getCertValidFrom( string $dateFormat = self::TOKEN_TIMESTAMP_FORMAT )
Get the UTC date from which the X.509 certificate that is included in the XML token is valid. |
public
string|null|false
|
#
getCertValidTo( string $dateFormat = self::TOKEN_TIMESTAMP_FORMAT )
Get the UTC date to which the X.509 certificate that is included in the XML token is valid. |
public
boolean
|
#
isCertOutOfDate( )
Indicates whether the X.509 certificate included in the XML token is out of date or not. |
public
boolean
|
#
isValidCertIssuer( array $expectedIssuerInfo )
Check that the issuer information of the X.509 certificate that is included in the XML token matches the expected one. |
public
boolean
|
#
isValidCertCA( string $caCertPath )
Check that the X.509 certificate included in the XML token comes from the expected CA. |
public static
string|false
|
|
public
string
|
|
public
|
string |
XMLDSIG_NS_PREFIX
|
#
'ds'
|
string |
TOKEN_NAME
|
#
'Token'
|
string |
TOKEN_DATA_NAME
|
#
'TokenData'
|
string |
TOKEN_TIMESTAMP_NAME
|
#
'TokenTimestamp'
|
string |
TOKEN_TIMESTAMP_FORMAT
|
#
'Y-m-d\TH:i:s\Z'
|
integer |
TOKEN_DEFAULT_TTL
|
#
60
|
integer |
DESYNC_TOLERANCE
|
#
30
|
string |
C14N
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::C14N
|
string |
C14N_COMMENTS
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::C14N_COMMENTS
|
string |
EXC_C14N
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::EXC_C14N
|
string |
EXC_C14N_COMMENTS
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::EXC_C14N_COMMENTS
|
string |
SHA1
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::SHA1
|
string |
SHA256
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::SHA256
|
string |
SHA384
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::SHA384
|
string |
SHA512
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::SHA512
|
string |
RIPEMD160
|
#
webcoder31\ezxmldsig\XMLSecurityDSig::RIPEMD160
|
string |
TRIPLEDES_CBC
|
#
webcoder31\ezxmldsig\XMLSecurityKey::TRIPLEDES_CBC
|
string |
AES128_CBC
|
#
webcoder31\ezxmldsig\XMLSecurityKey::AES128_CBC
|
string |
AES192_CBC
|
#
webcoder31\ezxmldsig\XMLSecurityKey::AES192_CBC
|
string |
AES256_CBC
|
#
webcoder31\ezxmldsig\XMLSecurityKey::AES256_CBC
|
string |
RSA_1_5
|
#
webcoder31\ezxmldsig\XMLSecurityKey::RSA_1_5
|
string |
RSA_OAEP_MGF1P
|
#
webcoder31\ezxmldsig\XMLSecurityKey::RSA_OAEP_MGF1P
|
string |
DSA_SHA1
|
#
webcoder31\ezxmldsig\XMLSecurityKey::DSA_SHA1
|
string |
RSA_SHA1
|
#
webcoder31\ezxmldsig\XMLSecurityKey::RSA_SHA1
|
string |
RSA_SHA256
|
#
webcoder31\ezxmldsig\XMLSecurityKey::RSA_SHA256
|
string |
RSA_SHA384
|
#
webcoder31\ezxmldsig\XMLSecurityKey::RSA_SHA384
|
string |
RSA_SHA512
|
#
webcoder31\ezxmldsig\XMLSecurityKey::RSA_SHA512
|
string |
HMAC_SHA1
|
#
webcoder31\ezxmldsig\XMLSecurityKey::HMAC_SHA1
|