SignXML

https://github.com/xml-security/signxml
Admin
SignXML is a Python implementation of the W3C XML Signature standard for creating and verifying XML...
Tokens:6,072
Snippets:89
Trust Score:6.7
License:Apache-2.0
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install SignXML

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Install the library using pip.

```bash
pip install signxml
```

--------------------------------

### Verify XML with Extension Policy

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Configures an extension policy for X509 verification and applies it during the verification process.

```python
ee_policy = x509.verification.ExtensionPolicy.permit_all()

XMLVerifier(...).verify(..., ee_policy=ee_policy)
```

--------------------------------

### Configure Namespace Prefixes

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Sets custom namespace prefixes for XML signature generation by modifying the XMLSigner namespaces attribute.

```python
signer = signxml.XMLSigner(...)
signer.namespaces = {None: signxml.namespaces.ds}
signed_root = signer.sign(...)
```

--------------------------------

### Sign and Verify XML

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Basic usage of XMLSigner and XMLVerifier to sign and verify an XML element.

```python
from lxml import etree
from signxml import XMLSigner, XMLVerifier

data_to_sign = "<Test/>"
cert = open("cert.pem").read()
key = open("privkey.pem").read()
root = etree.fromstring(data_to_sign)
signed_root = XMLSigner().sign(root, key=key, cert=cert)
verified_data = XMLVerifier().verify(signed_root).signed_xml
```

--------------------------------

### Sign and Verify Detached XML Signatures

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Demonstrates creating a detached signature by specifying the method and verifying the resulting data.

```python
signed_root = XMLSigner(method=signxml.methods.detached).sign(root, key=key, cert=cert)
verified_data = XMLVerifier().verify(signed_root).signed_xml
```

--------------------------------

### Generate Test Certificate

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Command to generate a self-signed certificate and private key for testing purposes.

```bash
openssl req -x509 -nodes -subj "/CN=test" -days 1 -newkey rsa -keyout privkey.pem -out cert.pem -addext "keyUsage = digitalSignature"
```

--------------------------------

### Verify SAML assertions with XMLVerifier

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Extracts an X.509 certificate from metadata and verifies the assertion body.

```python
from lxml import etree
from base64 import b64decode
from signxml import XMLVerifier

with open("metadata.xml", "rb") as fh:
    cert = etree.parse(fh).find("//ds:X509Certificate").text

assertion_data = XMLVerifier().verify(b64decode(assertion_body), x509_cert=cert).signed_xml
```

--------------------------------

### Verify XAdES signatures with SignXML

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Use the XAdESVerifier class to verify signed documents and access parsed XAdES properties.

```python
verifier = XAdESVerifier()
verify_results = verifier.verify(
    signed_doc, x509_cert=certificate, expect_references=3, expect_signature_policy=signature_policy
)
for verify_result in verify_results:
    if isinstance(verify_result, XAdESVerifyResult):
        verify_result.signed_properties  # use this to access parsed XAdES properties
```

--------------------------------

### Configure signature location expectations

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Uses SignatureConfiguration to enforce expected paths for the ds:Signature element during verification.

```python
from signxml import XMLVerifier, SignatureConfiguration
config = SignatureConfiguration(location="./")
XMLVerifier(...).verify(..., expect_config=config)
```

```python
config = SignatureConfiguration(
    location="./{urn:oasis:names:tc:SAML:2.0:assertion}Assertion/"
)
XMLVerifier().verify(response_xml, x509_cert=cert, expect_config=config)
```

--------------------------------

### Create XAdES Signatures

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Configures XAdES signature policy and data object format to sign documents with advanced electronic signature metadata.

```python
from signxml import DigestAlgorithm
from signxml.xades import (XAdESSigner, XAdESVerifier, XAdESVerifyResult,
                           XAdESSignaturePolicy, XAdESDataObjectFormat)
signature_policy = XAdESSignaturePolicy(
    Identifier="MyPolicyIdentifier",
    Description="Hello XAdES",
    DigestMethod=DigestAlgorithm.SHA256,
    DigestValue="Ohixl6upD6av8N7pEvDABhEL6hM=",
)
data_object_format = XAdESDataObjectFormat(
    Description="My XAdES signature",
    MimeType="text/xml",
)
signer = XAdESSigner(
    signature_policy=signature_policy,
    claimed_roles=["signer"],
    data_object_format=data_object_format,
    c14n_algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315",
)
signed_doc = signer.sign(doc, key=private_key, cert=certificate)
```

--------------------------------

### Verify signatures at a specific time

Source: https://github.com/xml-security/signxml/blob/main/README.rst

Configures a verification time to validate archived signatures against expired certificates.

```python
from datetime import datetime, timezone
from signxml import SignatureConfiguration, XMLVerifier

config = SignatureConfiguration(
    verification_time=datetime(2018, 5, 28, 17, 0, tzinfo=timezone.utc)
)
verified_data = XMLVerifier().verify(data, expect_config=config).signed_xml
```

--------------------------------

### Configure empty xmlns declaration excision

Source: https://github.com/xml-security/signxml/blob/main/Changes.rst

Control whether empty xmlns declarations are excised during signing or verification processes.

```python
signer = XMLSigner()
signer.excise_empty_xmlns_declarations = True
signer.sign(...)
```

```python
verifier = XMLVerifier()
verifier.excise_empty_xmlns_declarations = True
verifier.verify(...)
```

--------------------------------

### Define TimeStampReq Structure

Source: https://github.com/xml-security/signxml/blob/main/test/rfc3161.txt

ASN.1 sequence structure for a time-stamping request message.

```ASN.1
TimeStampReq ::= SEQUENCE  {
   version                      INTEGER  { v1(1) },
   messageImprint               MessageImprint,
     --a hash algorithm OID and the hash value of the data to be
     --time-stamped
   reqPolicy             TSAPolicyId              OPTIONAL,
   nonce                 INTEGER                  OPTIONAL,
   certReq               BOOLEAN                  DEFAULT FALSE,
   extensions            [0] IMPLICIT Extensions  OPTIONAL  }
```

--------------------------------

### Define id-kp-timeStamping Object Identifier

Source: https://github.com/xml-security/signxml/blob/main/test/rfc3161.txt

ASN.1 definition for the time-stamping key purpose object identifier.

```ASN.1
id-kp-timeStamping OBJECT IDENTIFIER ::= {iso(1)
                identified-organization(3) dod(6)
                internet(1) security(5) mechanisms(5) pkix(7)
                kp (3) timestamping (8)}
```

--------------------------------

### ASN.1 Module Definitions for TSP

Source: https://github.com/xml-security/signxml/blob/main/test/rfc3161.txt

Defines the core structures for time-stamp requests and responses, including message imprints and status information.

```ASN.1
PKIXTSP {iso(1) identified-organization(3) dod(6) internet(1)
   security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-tsp(13)}

DEFINITIONS IMPLICIT TAGS ::=

BEGIN

-- EXPORTS ALL --

IMPORTS




Adams, et al.               Standards Track                    [Page 21]

RFC 3161               Time-Stamp Protocol (TSP)             August 2001


     Extensions, AlgorithmIdentifier
     FROM PKIX1Explicit88 {iso(1) identified-organization(3)
     dod(6) internet(1) security(5) mechanisms(5) pkix(7)
     id-mod(0) id-pkix1-explicit-88(1)}

     GeneralName FROM PKIX1Implicit88 {iso(1)
     identified-organization(3) dod(6) internet(1) security(5)
     mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-88(2)}

     ContentInfo FROM CryptographicMessageSyntax {iso(1)
     member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
     smime(16) modules(0) cms(1)}

     PKIFreeText FROM PKIXCMP {iso(1) identified-organization(3)
     dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
     id-mod-cmp(9)} ;

                     --  Locally defined OIDs  --

-- eContentType for a time-stamp token

id-ct-TSTInfo  OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) ct(1) 4}

-- 2.4.1

TimeStampReq ::= SEQUENCE  {
   version                  INTEGER  { v1(1) },
   messageImprint           MessageImprint,
     --a hash algorithm OID and the hash value of the data to be
     --time-stamped
   reqPolicy                TSAPolicyId                OPTIONAL,
   nonce                    INTEGER                    OPTIONAL,
   certReq                  BOOLEAN                    DEFAULT FALSE,
   extensions               [0] IMPLICIT Extensions    OPTIONAL  }

MessageImprint ::= SEQUENCE  {
     hashAlgorithm                AlgorithmIdentifier,
     hashedMessage                OCTET STRING  }

TSAPolicyId ::= OBJECT IDENTIFIER


-- 2.4.2

TimeStampResp ::= SEQUENCE  {
     status                  PKIStatusInfo,
     timeStampToken          TimeStampToken     OPTIONAL  }



Adams, et al.               Standards Track                    [Page 22]

RFC 3161               Time-Stamp Protocol (TSP)             August 2001


-- The status is based on the definition of status
-- in section 3.2.3 of [RFC2510]

PKIStatusInfo ::= SEQUENCE {
    status        PKIStatus,
    statusString  PKIFreeText     OPTIONAL,
    failInfo      PKIFailureInfo  OPTIONAL  }
```

--------------------------------

### Define SignatureTimeStampToken Type

Source: https://github.com/xml-security/signxml/blob/main/test/rfc3161.txt

Defines the ASN.1 type for the Signature time-stamp attribute value.

```ASN.1
SignatureTimeStampToken ::= TimeStampToken
```

--------------------------------

### Define Signature Time-stamp Attribute OID

Source: https://github.com/xml-security/signxml/blob/main/test/rfc3161.txt

Defines the object identifier for the Signature Time-stamp attribute.

```ASN.1
id-aa-timeStampToken OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) aa(2) 14 }
```
Tokens:
Raw