XML Digital Signature in Java

As you know XML plays a significant role in our product or project development and from an XML document we gather much of the information. Do you know that the data you are reading from a XML document is authentic? Are you sure that the XML document has come from a trusted source? There may be many questions about the authenticity or originality of the data from an XML file. It is a common practice that whenever we encounter an XML document we directly process the XML document by parsing the document, we hardly care about the data security. But there are situations where all the points and questions made in the preceding lines are relevant. Let us consider a real-world situation. Whenever we get a letter or mail from our Post Office, how do we know that the letter has come from our friends? It is based upon his/her typical statements or words or address details. It may be his/her character signature. Now-a-days it is also possible that the letter we have received has been modified by an unknown person by adding an another page. For all those reasons we normally verify the handwriting signature of our friend. This is all about the normal Post Office letter. What about an electronic message? How can we verify that the electronic message is authentic? In this case we need to adopt the technology for digital signature. In this article, I will present a brief glimpse at XML Digital Signatures that play a significant role for our data integrity. In this article I will show you how to attach a digital signature to an XML document and how to verify the XML document with the attached signature.

In the last couple of years XML Digital Signatures have gained momentum, particularly in the field of the financial sector. Before we jump into XML Digital Signatures, let us consider a typical scenario for our understanding. Think about a situation where an organization sends all the salary details of its employees to the Income Tax department in the form of a XML document. How does the Income Tax department verify the XML document? It means the IT department must verify the sensitive information of all the employees of the organization. The IT department must ensure that the XML document has come from a trusted source and the document has not yet been modified while coming to the IT department. It means the document has not been tampered with in between. First of all we need to understand the concept of digital signatures. A Digital Signature is an electronic signature that validates the authenticity of the document sent by a trusted person. It also provides assurance that the original content of the document has not been modified during transmission. A digital signature can be used with any message, whether it is encrypted or not, so that the receiver can be sure of the identity of the sender and that the message has not been altered by an unknown person. According to Wikipedia, a digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender, such that the sender cannot deny having sent the message (authentication and non-repudiation) and that the message was not altered in transit (integrity). Digital signatures are commonly used for software distribution, financial transactions, and in other cases where it is important to detect forgery or tampering.

Let us see a complete XML document with a digital signature.

The preceding XML file is a digitally signed one which can be verified at any point of time. The preceding XML file contains information about the employee name, account number and salary amount. But the actual digital signature is attached within the tag <Signature></Signature>. The information lying inside <Signature> provides the authenticity of the document. As you are able to see the data, you can freely change the data, but it will fail in the case of a signature verification process. Now let us see the skeletal structure of a XML Digital Signature below.