Firefox Add-On for XML Digital Signature, XML Encryption, and SAML Assertions

Subrata Mazumdar, Avaya Labs Research, Avaya Inc.  

 

Table of Contents

XML Digital Signature Tool 
XML Encryption Tool 
SAML Assertion Tool
HTML Document Signing Tool 
How To Use the Tools in this Add-on 

Related Information

 

XML Digital Signature Tool 

The XML digital signature tool is built on top of Apache XML security library (called XSEC). The Apache XML security  library has a plug-in for Mozilla NSS library.  We added an XPCOM based thin layer for accessing the Mozilla NSS plug-in in XSEC library from the browser. Our XPCOM IDL based layers allows any Firefox based extension to access XSEC library using JavaScript and C++. 

This tool visually guides an user to select various XML signature parameters. All the options are presented for the user and user has to choose form the listed options. This tool allows an user to build the whole XML Signature element before sending it to the apache library for signature.

 The following picture describes a snapshots of the XUL based Signing form for the tool.

This tools automatically selects a list of user signing certificates which can be used to sign XML documents and present them as a menu list. The XML file to be signed is picked using the file browser. The signature parameters are chosen form a set of lists. 

 

 

The figure below describes the wizard for implementing  workflow for signing and verification of XML Digital Signature and encryption and decryption of XML documents. 

Architecture of XPCOM Implementation  of XML Digital Signature Tool  

 

JavaScript Usage of the XPCOM IDL Interface 

    /* Create an instance of XML Signature Tool */

    var /* alrIXPXmlDSigTool */ xmlDSigTool = null;

    try {

        xmlDSigTool = Components.classes["@avaya.com/pkm/xmldsigtool;1"].

                       createInstance(Components.interfaces.alrIXPXmlDSigTool);

    } catch (ex) {

        throw ex;

    }

 

    var /* nsIX509Cert   */ signerCert; 

    var /* nsILocalFile  */ inputXMLFile;

    var /* nsIProperties */ xmlSigProps;

    var /* nsILocalFile  */ outSignedXMLFile;

 

    xmlSigProps = Components.classes["@mozilla.org/persistent-properties;1"].

                  createInstance(Components.interfaces.nsIPersistentProperties);

    var propKey;

    var propValue;

    var propOldValue;

    var trueValue = "true";

    propKey =  "keyinfoName"; propValue = trueValue;

    propOldValue = xmlSigProps.setStringProperty(propKey, propValue);

    propKey =  "keyinfoX509"; propValue = trueValue;

    propOldValue = xmlSigProps.setStringProperty(propKey, propValue);

    propKey =  "canonicalizationMethod"; propValue = "C14N_NOC";

    propOldValue = xmlSigProps.setStringProperty(propKey, propValue);

    propKey =  "hashAlgorithm"; propValue = "SHA1";

    propOldValue = xmlSigProps.setStringProperty(propKey, propValue);

    propKey =  "transformType"; propValue = "ENVELOPED_SIGNATURE";

    propOldValue = xmlSigProps.setStringProperty(propKey, propValue);

 

    try {

        // Token login 

        // xmldsigffext_loginToCertToken(signerCert);

 

        xmlDSigTool.signXMLFileByX509Cert(

             signerCert, inputXMLFile, xmlSigProps, outSignedXMLFile

             );

    } catch (ex) {

         throw ex;

    }

 

XML Encryption Tool 

Encryption Form

 

Decryption Form : 

 

SAML Assertion Tool and Self-Issued Token for Digital Identity

The Figure above describes the XUL GUI for the Self-issued SAML token. The XUL GUI reuses the XUL based XML Signature GUI elements for the signing the XML document for the SAML token. The XML document for the self-issued token is derived from the selected user certificate. The certificate selection element (labeled “Signer Certificate”) lists only those user certificates (in the browser’s certificate DB) that match key usage criteria for document signing. Depending upon the type of the SAML version, appropriate SAML token document is generated. If the version 1.1 is chosen for the token type, then it presents two different options for the name space prefix for the attribute names: MS Info card or SAML Basic . If the version 2.0 is chosen, then the two different options are presented: SAMLv2 Basic and SAMLv2 X500 LDAP . 

 

 

As described before, we have used the following the recommendation for the XML signature profile that is used to create the SAML self-issued token:

The ds:KeyInfo element is always present in the signature and contains  the following child elements (the last two elements are our additions for experimentation) : 

  1. signing RSA key value in the form of a ds:RSAKeyValue element

  2. Subject DN of in the certificate in the form of ds:keyName element and ds:X509Data/X509Subject element

  3. Base64 data for the certificate in the form of ds:X509Data/X509Certificate element

Since the signature parameters are fixed, the input control for the signature parameter elements in the XUL GUI are disabled.

HTML  Document Signing Tool 

HTML document signing tool and HTML signature validation is an implementation of the HTML Signing Profile.

HTML document signing tool and HTML signature validation is disabled by default. You have to explicitly enable it to use it. Use the Preference window to enable it as follows: 

If the HTML signature validation is enabled, then a small icon appears on the status bar of the browser if the page contains HTML signature. This status icon displays the information about the signature and the results of the signature validation. 

 

 

How to Download  and Install XML Digital Signature Tool  Add-On:

Prerequisites: 

Note:  If you are going to generate WebLM license file in DTD format (which is not consistent with XML Signature spec), then you won't need to install Apache XML libraries and skip this section. 

Apache XML Libraries Installation and Configuration Instructions for Firefox 5.0+:

Install Apache XML Libraries: 

Note: XPI file for this add-on includes Apache XML security libraries for C++. The default XSEC-binary from Apache is not compiled for Mozilla NSS. So we provide our compiled version of NSS-enabled XSEC-C++ library. 

Quick Setup: 

  1. Load the URL of this page in Firefox browser 
  2. Download  the Add-on from https://addons.mozilla.org/en-US/firefox/addon/4522/
  3. Install  the downloaded (XPI) file by opening it using the Firefox browser ("File->Open File")

     

  4. Restart the browser and check for updates using Add-on  manager ( "Tools->Add On"). 

Note

 

How To Use the Tools in this Add-on

XML  Digital Signature Tool 

SAML Token Tool 

HTML  Document Signing Tool 

 

Javascript API Usage:

 

Launch XML Signature Tool Dialog

function xmldsigtool_cmdSignXmlDoc(unsignedXmlDocFilePath, signedXmlDocFilePath)

{

    dump("xmldsigtool_cmdSignXmlDoc():..................Start.\n");

 

    dump("xmldsigtool_cmdSignXmlDoc():unsignedXmlDocFilePath: " + unsignedXmlDocFilePath + "\n");

    dump("xmldsigtool_cmdSignXmlDoc():signedXmlDocFilePath: " + signedXmlDocFilePath + "\n");

 

    // We are now ready to sign the unsigned XML doc file.

 

    // TODO: If you invoking this method from a downloaded HTML file uncomment the following line.

    // netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");

   

    var dialogParams = Components.classes["@mozilla.org/embedcomp/dialogparam;1"]

                           .createInstance(Components.interfaces.nsIDialogParamBlock);

    var argc = 0;

    dialogParams.SetString(argc, unsignedXmlDocFilePath); argc++;

    dialogParams.SetString(argc, signedXmlDocFilePath); argc++;

    dialogParams.SetInt(0, argc);

    window.openDialog('chrome://xmldsigffext/content/xmldsig/XmlDigitalSigTool.xul',

                           '_blank', 'chrome,centerscreen,resizable,modal,titlebar', dialogParams);

    var retVal = dialogParams.GetInt(0);

    if (retVal == 0) {

       alert("Failed to sign the input XML doc");

       return false;

    }

    dump("xmldsigtool_cmdSignXmlDoc():..................End.\n");

    return true;

}

function signXMLDoc()

{

    var unsignedXmlDocFilePath = null; /* input unsigned XML doc path */

    var signedXmlDocFilePath = null; /* out signed XML doc */

 

    // TODO: Initilize the path for inout and putput XML docs.

 

    xmldsigtool_cmdSignXmlDoc(unsignedXmlDocFilePath, signedXmlDocFilePath);

}

 

Related Info: 

  1. KeyManager Add-on for Firefox : https://addons.mozilla.org/en-US/firefox/addon/4471

  2. XML Digital Signature Tool: http://pubs.research.avayalabs.com/pdfs/ALR-2007-013.pdf.