Set Up Key Exchange Provide a Receiver Hint

Oracle XML Security 8-7

8.3.2.1 Set Up Key Exchange

The key exchange needs to happen out of band. For example, if you signing with a certificate, the receiver should already be set up with the trust points, so that the receiver can verify your certificate. Or if you are signing with a symmetric key, the receiver should already know this symmetric key. The XML Signature specification does not define this initial key exchange mechanism.

8.3.2.2 Provide a Receiver Hint

You also need to provide a hint to the receiver so that it knows how to verify your signature. This will be in the dsig:KeyInfo tag inside the dsig:Signature. This can be accomplished in different ways: ■ You can provide no hint at all. This perfectly acceptable, if you have already communicated the key to the receiver, and the receiver is expecting all signatures to be signed by this key. However this is not a likely situation. ■ When signing with an X509Certificate, you can provide one or more of the following: – The entire X509Certificate. This is the most common usage. – The Subject DN of the certificate – This is useful when the receiver has access to a LDAP directory, and it can look up the certificate based on the DN. – The SubjectKeyIdentifier or the IssuerDNSerial number pair – This is useful when the receiver is only expecting a signatures from a set of certificates, and it every time it has to verify a signature, it can loop over all the certificates and find the one with matching SKI or IssuerSerial. ■ When signing with a raw asymmetric key, you can provide the actual values of the RSADSADH public key. This is not recommended as the receiver cannot verify the key; alternatively, if you include the certificate, the receiver can do PKIX processing and verify it; that is, the receiver can check for certificate validity and check against an OCSP or CRL. ■ When signing with a symmetric key, you can provide a key name. This is just a string that conveys some information that the receiver can use to retrieveconstruct the symmetric key.

8.4 How Data is Verified