All geek questions in one place

The expression SignedXml.CheckSignature calls: the value cannot be null. Parameter Name: Name

I am writing a code snippet to verify the signature in Xml from an X509 certificate and received an exception message in the subject line.

My sample code

Dim cert As X509Certificate2 = GetCertificate("Certificate Name") Dim signedXml As SignedXml = New SignedXml(Me.samlResponseXml) If (signedXml.CheckSignature(cert, True)) Then ' The signature is valid Else ' The signature is invalid Throw New ArgumentException("Invalid signature found in Saml Xml.") End If

I successfully downloaded the certificate from my certificate store (1st line of code). I successfully populated signedXml (second line of code).

An exception is signedXml.CheckSignature(cert, True) when the signedXml.CheckSignature(cert, True) function is called. The message is very fuzzy:

The value cannot be null.
Parameter Name: Name

Any sense what is wrong here?

Call Stacks:

System.ArgumentNullException is not handled by user code
Message = Value cannot be null. Parameter Name: name ParamName = name
Source = mscorlib StackTrace: in System.Security.Cryptography.CryptoConfig.CreateFromName (string name, object [] args) in System.Security.Cryptography.Xml.SignedXml.CheckSignedInfo (asymmetric algorithm key) in System.Security.Cryptography.Xml. SignedXml.CheckSignature (asymmetric algorithm key) in System.Security.Cryptography.Xml.SignedXml.CheckSignature (X509Certificate2 certificate, Boolean verification SignatureOnly) in MyNamespace.MyClass.MyFunction () in D: \ Projects \ Mybject 117. Test

Update 1 I turned on the .Net Framework source debug, and the exception is thrown from the SignedXml.CheckSignedInfo method, there is a line of code

SignatureDescription signatureDescription = CryptoConfig.CreateFromName(SignatureMethod) as SignatureDescription;

Obviously SignatureMethod is a wrapper

  public string SignatureMethod { get { return m_signature.SignedInfo.SignatureMethod; } }

m_signature.SignedInfo.SignatureMethod is a null value. I again read the SignatureMethod explanation from MSDN at http://msdn.microsoft.com/en-us/library/system.security.cryptography.xml.signedxml.signaturemethod.aspx and checked the Xml code with the signature part below. I have a SignatureMethod tag with values ​​in it, but why can't SignedXml process it?

  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <Reference URI="#_ea559faf-417b-407f-bdc2-bccc76dab76c"> <Transforms> <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /> </Transform> </Transforms> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <DigestValue>fvQx+J90ZGKhwj8Mfhg6v/esOtI=</DigestValue> </Reference> </SignedInfo> <SignatureValue>Ft2mQEA3a39uRq5N94pDI8Y6B/UGLXHkZJ+/besOQmEtZoi630vBDzQfIxx5Djgg6YYeF/s67iF+KLgfvBrHxoe3E8xiqTwBigem41+PJdITlwgrOTkLo2sSdj4DaFdxeN+SCy6KfKXpDBvDyN4i/R0hBKodGwytfzK/DMeOhHU=</SignatureValue> <KeyInfo> <X509Data> <X509Certificate>MIICBjCCAXOgAwIBAgIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAMBwxGjAYBgNVBAMTEUlkZW50aXR5UHJvdmlkZXIxMB4XDTExMDkwMTA1MDAwMFoXDTQwMTIzMTA1MDAwMFowHDEaMBgGA1UEAxMRSWRlbnRpdHlQcm92aWRlcjEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMBVhtKneTweMOgmvwO+i8AvZ5p0/PGatzLKNXVctTROcXb48u3L9JR3sVPasAFNsafq086xqaWyuFM7jAHtYHTQg/oLt+wGCKd7w/n4s0crxM3NVahDmSUPnBW9RZM2XD4pOs9DTu8aEEQGN/p01jrIMgPYhdlVsTJSg43lLyzjAgMBAAGjUTBPME0GA1UdAQRGMESAEHDoTOJwf2lSgqgCU4TXI2ShHjAcMRowGAYDVQQDExFJZGVudGl0eVByb3ZpZGVyMYIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAA4GBAKvsy5KkU9dDNWDRW55/+s7txFfl4ZmWw45AmZYXEA90g+xzALFtWbX/QGqCOx4C0h5fB5Oco084B7gJK/uf2a8oaYvxYGwlxgRxJ9Dq5XBx5ZhOuobT8G2xVy575cbaGnFbObG6/E33Mva1gAYdw7rvGaz/dYuBeChsEIvzROYU</X509Certificate> </X509Data> </KeyInfo> </Signature> besOQmEtZoi630vBDzQfIxx5Djgg6YYeF / s67iF + KLgfvBrHxoe3E8xiqTwBigem41 + PJdITlwgrOTkLo2sSdj4DaFdxeN + SCy6KfKXpDBvDyN4i / R0hBKodGwytfzK / DMeOhHU = </ SignatureValue>  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <Reference URI="#_ea559faf-417b-407f-bdc2-bccc76dab76c"> <Transforms> <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /> </Transform> </Transforms> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <DigestValue>fvQx+J90ZGKhwj8Mfhg6v/esOtI=</DigestValue> </Reference> </SignedInfo> <SignatureValue>Ft2mQEA3a39uRq5N94pDI8Y6B/UGLXHkZJ+/besOQmEtZoi630vBDzQfIxx5Djgg6YYeF/s67iF+KLgfvBrHxoe3E8xiqTwBigem41+PJdITlwgrOTkLo2sSdj4DaFdxeN+SCy6KfKXpDBvDyN4i/R0hBKodGwytfzK/DMeOhHU=</SignatureValue> <KeyInfo> <X509Data> <X509Certificate>MIICBjCCAXOgAwIBAgIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAMBwxGjAYBgNVBAMTEUlkZW50aXR5UHJvdmlkZXIxMB4XDTExMDkwMTA1MDAwMFoXDTQwMTIzMTA1MDAwMFowHDEaMBgGA1UEAxMRSWRlbnRpdHlQcm92aWRlcjEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMBVhtKneTweMOgmvwO+i8AvZ5p0/PGatzLKNXVctTROcXb48u3L9JR3sVPasAFNsafq086xqaWyuFM7jAHtYHTQg/oLt+wGCKd7w/n4s0crxM3NVahDmSUPnBW9RZM2XD4pOs9DTu8aEEQGN/p01jrIMgPYhdlVsTJSg43lLyzjAgMBAAGjUTBPME0GA1UdAQRGMESAEHDoTOJwf2lSgqgCU4TXI2ShHjAcMRowGAYDVQQDExFJZGVudGl0eVByb3ZpZGVyMYIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAA4GBAKvsy5KkU9dDNWDRW55/+s7txFfl4ZmWw45AmZYXEA90g+xzALFtWbX/QGqCOx4C0h5fB5Oco084B7gJK/uf2a8oaYvxYGwlxgRxJ9Dq5XBx5ZhOuobT8G2xVy575cbaGnFbObG6/E33Mva1gAYdw7rvGaz/dYuBeChsEIvzROYU</X509Certificate> </X509Data> </KeyInfo> </Signature> / oLt + wGCKd7w / n4s0crxM3NVahDmSUPnBW9RZM2XD4pOs9DTu8aEEQGN / p01jrIMgPYhdlVsTJSg43lLyzjAgMBAAGjUTBPME0GA1UdAQRGMESAEHDoTOJwf2lSgqgCU4TXI2ShHjAcMRowGAYDVQQDExFJZGVudGl0eVByb3ZpZGVyMYIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAA4GBAKvsy5KkU9dDNWDRW55 / + s7txFfl4ZmWw45AmZYXEA90g + xzALFtWbX / QGqCOx4C0h5fB5Oco084B7gJK / uf2a8oaYvxYGwlxgRxJ9Dq5XBx5ZhOuobT8G2xVy575cbaGnFbObG6 / E33Mva1gAYdw7rvGaz / dYuBeChsEIvzROYU </ X509Certificate>  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <Reference URI="#_ea559faf-417b-407f-bdc2-bccc76dab76c"> <Transforms> <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /> </Transform> </Transforms> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <DigestValue>fvQx+J90ZGKhwj8Mfhg6v/esOtI=</DigestValue> </Reference> </SignedInfo> <SignatureValue>Ft2mQEA3a39uRq5N94pDI8Y6B/UGLXHkZJ+/besOQmEtZoi630vBDzQfIxx5Djgg6YYeF/s67iF+KLgfvBrHxoe3E8xiqTwBigem41+PJdITlwgrOTkLo2sSdj4DaFdxeN+SCy6KfKXpDBvDyN4i/R0hBKodGwytfzK/DMeOhHU=</SignatureValue> <KeyInfo> <X509Data> <X509Certificate>MIICBjCCAXOgAwIBAgIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAMBwxGjAYBgNVBAMTEUlkZW50aXR5UHJvdmlkZXIxMB4XDTExMDkwMTA1MDAwMFoXDTQwMTIzMTA1MDAwMFowHDEaMBgGA1UEAxMRSWRlbnRpdHlQcm92aWRlcjEwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMBVhtKneTweMOgmvwO+i8AvZ5p0/PGatzLKNXVctTROcXb48u3L9JR3sVPasAFNsafq086xqaWyuFM7jAHtYHTQg/oLt+wGCKd7w/n4s0crxM3NVahDmSUPnBW9RZM2XD4pOs9DTu8aEEQGN/p01jrIMgPYhdlVsTJSg43lLyzjAgMBAAGjUTBPME0GA1UdAQRGMESAEHDoTOJwf2lSgqgCU4TXI2ShHjAcMRowGAYDVQQDExFJZGVudGl0eVByb3ZpZGVyMYIQ3VhOVESMV71O0q5EttLxxDAJBgUrDgMCHQUAA4GBAKvsy5KkU9dDNWDRW55/+s7txFfl4ZmWw45AmZYXEA90g+xzALFtWbX/QGqCOx4C0h5fB5Oco084B7gJK/uf2a8oaYvxYGwlxgRxJ9Dq5XBx5ZhOuobT8G2xVy575cbaGnFbObG6/E33Mva1gAYdw7rvGaz/dYuBeChsEIvzROYU</X509Certificate> </X509Data> </KeyInfo> </Signature>
+4
source share
1 answer

SignedXml requires two steps to validate. Step 1 is the construction where you give it a document or element in which signed elements will be found. The second part is that you need to load the Signature element (which could be obtained from another document) using the LoadXml method.

To take an example from the MSDN SignedXml page , but change it for certificates:

 public static Boolean VerifyXmlFile(XmlElement samlResponseXml, X509Certificate2 cert) { // Create a new SignedXml object and pass it the XML. SignedXml signedXml = new SignedXml(samlResponseXml); // Find the "Signature" node and create a new XmlNodeList object. XmlNodeList nodeList = xmlDocument.GetElementsByTagName("Signature"); // TODO: Error checking. Was it found? Were too many found? // Load the signature node. signedXml.LoadXml((XmlElement)nodeList[0]); // Check the signature and return the result. return signedXml.CheckSignature(cert, true); }

When using SignedXml, you should consider the problems that arise from the "Notes" section of the MSDN page. In particular, ensure that the signing key is suitable for the signed content (similar to verifying the host name during a TLS session).

+1
source

Source: https://habr.com/ru/post/1403995/

More articles:


All Articles