如何借助Java中的公钥证书验证aadhar XML签名？

Question

我正在研究 Aadhaar 无纸化离线 e-kyc，尝试使用公钥证书验证 aadhaar XML 签名。但我不确定这是否是正确的做法。下面是java代码供参考。

public static void validateXMLSignature() throws Exception {
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    DocumentBuilder db = dbf.newDocumentBuilder();

    ClassLoader classLoader = AadhaarXMLSignatureValidation.class.getClassLoader();

    
    File file1 = new File("path-to-xml-file/aadhaar.xml");
    Document document = db.parse(file1);
    document.normalizeDocument();

    // Find Signature element
    NodeList nl =
        document.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
    if (nl.getLength() == 0) {
        throw new Exception("Cannot find Signature element");
    }

    FileInputStream fin = new FileInputStream("path-to-certificate-file/certificate.cer");
    CertificateFactory f = CertificateFactory.getInstance("X.509");
    X509Certificate certificate = (X509Certificate)f.generateCertificate(fin);
    PublicKey publicKey = certificate.getPublicKey();

    // Create a DOM XMLSignatureFactory that will be used to unmarshal the
    // document containing the XMLSignature
    XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");

    // Create a DOMValidateContext and specify a X509KeySelector
    // and document context
    DOMValidateContext valContext = new DOMValidateContext(publicKey,
        nl.item(0));

    // unmarshal the XMLSignature
    XMLSignature signature = fac.unmarshalXMLSignature(valContext);

    // Validate the XMLSignature (generated above)
    boolean coreValidity = signature.validate(valContext);

    //    Check core validation status
    if (!coreValidity) {
        System.err.println("Signature failed core validation");
    } else {
        System.out.println("Signature passed core validation");
    }
}

谁能告诉我我错过了什么？ 以下是 Aadhaar 无纸化离线 e-kyc 教程的链接 https://uidai.gov.in/ecosystem/authentication-devices-documents/about-aadhaar-paperless-offline-e-kyc.html

Answer 1

您可以尝试使用以下方法从证书字符串中提取 X509Certificate。

private static X509Certificate getCertificateFromFile(String aadhaarCertificateString) throws GeneralSecurityException {
    CertificateFactory certFactory = CertificateFactory.getInstance(X509_CERTIFICATE_TYPE);
    InputStream inputStream = new ByteArrayInputStream(Base64.getDecoder().decode(aadhaarCertificateString));
    return (X509Certificate) certFactory.generateCertificate(inputStream);
}

Answer 2

我在验证 aadhaar XML 签名时也遇到了一些问题。只是在这里分享工作代码片段。

public static final String PEM_FILE_BEGIN = "\r\n-----BEGIN CERTIFICATE-----\r\n";

public static final String PEM_FILE_END = "\r\n-----END CERTIFICATE-----\r\n";

重要的是在公钥证书中附加 BEGIN 和 END 格式，并且它已经是 base64 字符串，因此无需对其进行解码。

public class AadhaarPaperlessOfflineEKYC {


public boolean verify() {

    String filePath = "pathTo/offlineaadhaar.xml";
    boolean verificationResult = false;

    try {

        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        dbf.setNamespaceAware(true);

        Document signedDocument = dbf.newDocumentBuilder().parse(new File(filePath));

        NodeList signatureNodeList = signedDocument.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
        NodeList X509CertificateNodeList = signedDocument.getElementsByTagName("X509Certificate");

        if (signatureNodeList.getLength() == 0 || X509CertificateNodeList.getLength() == 0) {
            throw new IllegalArgumentException("Cannot find Signature element");
        }

        String publicKeyFile = X509CertificateNodeList.item(0).getTextContent();
        publicKeyFile = Constants.PEM_FILE_BEGIN + publicKeyFile + Constants.PEM_FILE_END;

        XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");

        DOMValidateContext valContext = new DOMValidateContext(getCertificateFromString(publicKeyFile).getPublicKey(), signatureNodeList.item(0));
        XMLSignature signature = fac.unmarshalXMLSignature(valContext);

        verificationResult = signature.validate(valContext);

    } catch (Exception e) {
        log.error("Error while verifying digital signature: " + e);
        e.printStackTrace();
    }

    return verificationResult;
}


private static X509Certificate getCertificateFromString(String aadhaarCertificateString) throws GeneralSecurityException {
    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
    InputStream inputStream = new ByteArrayInputStream(aadhaarCertificateString.getBytes());
    return (X509Certificate) certFactory.generateCertificate(inputStream);
}