通过XML签名和加密更安全地交换数据

<docRoot>
    <a>Hello</a>
    <b>World</b>
</docRoot>

<docRoot>
    <a>Hello</a>
    <b>World</b>
    <Signature xmlns="http://www.w3c.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod
                Algorithm="http://www.w3c.org/TR/2001/REC-xml-c14n-20010315"/>
            <SignatureMethod
                Algorithm="http://www.w3c.org/2000/09/xmldsig#rsa-sha1"/>
            <Reference URI="">
                <Transforms>
                    <Transform
                        Algorithm=
                            "http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                </Transforms>
                <DigestMethod
                    Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
                <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>IoEwS(3 lines of Base64 text)XSo=</SignatureValue>
    </Signature>
</docRoot>

using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
// Also, add a reference to System.Security.dll

// Assume the data to sign is in the data.xml file, load it, and
// set up the signature object.
XmlDocument doc = new XmlDocument();
doc.Load("data.xml");
SignedXml sig = new SignedXml(doc);

// Make a random RSA key, and set it on the signature for signing.
RSA key = new RSACryptoServiceProvider();
sig.SigningKey = key;

// Create a Reference to the containing document, add the enveloped
// transform, and then add the Reference to the signature
Reference refr = new Reference("");
refr.AddTransform(new XmlDsigEnvelopedSignatureTransform());
sig.AddReference(refr);

// Compute the signature, add it to the XML document, and save
sig.ComputeSignature();
doc.DocumentElement.AppendChild(sig.GetXml());
doc.Save("data-signed.xml");

using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
// Also, add a reference to System.Security.dll

// Load the signed data
XmlDocument doc = new XmlDocument();
doc.PreserveWhitespace = true;
doc.Load("data-signed.xml");

// Find the Signature element in the document
XmlNamespaceManager nsm = new XmlNamespaceManager(new NameTable());
nsm.AddNamespace("dsig", SignedXml.XmlDsigNamespaceUrl);
XmlElement sigElt = (XmlElement)doc.SelectSingleNode(
    "//dsig:Signature", nsm);

// Load the signature for verification
SignedXml sig = new SignedXml(doc);
sig.LoadXml(sigElt);

// Verify the signature, assume the public key part of the
// signing key is in the key variable
if (sig.CheckSignature(key))
    Console.WriteLine("Signature verified");
else 
    Console.WriteLine("Signature not valid");

<Reference URI="http://www.example.com/foo.jpg">
    <DigestMethod
        Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1" />
    <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
</Reference>

// Create a Reference to detached data, assume a SignedXml object in sig
Reference refr = new Reference("http://www.example.com/foo.jpg");
sig.AddReference(refr);

<Reference URI="#myData">
    <DigestMethod
        Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1" />
    <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
</Reference>

<Object Id="myData">Your XML goes here</Object>

// Create a Reference to XML data in the containing document,
// assume a SignedXml object in sig
Reference refr = new Reference("#myData");
sig.AddReference(refr);

// Adds a DataObject with an Id of "#myData" to the signature, assume a 
// SignedXml object in sig, and xml data of type XmlNodeList in data
DataObject dobj = new DataObject();
dobj.Id = "myData"; // Note: no #
dobj.Data = data; // XML Data of the Object
sig.AddObject(dobj);

<a>
    <b>Some data</b>
    <c>More data</c>
</a>
<d>
    <b>Even more data</b>
</d>

<b>Some data</b>
<b>Even more data</b>

<Transform
    Algorithm="http://www.w3c.org/TR/1999/REC-xpath-19991116"
>
    <XPath>ancestor-or-self::b</XPath>
</Transform>

// Add an XPath transform to a reference.
// Assume a Reference object in refr 
XmlDocument doc = new XmlDocument();
doc.LoadXml("ancestor-or-self::b");
XmlDsigXPathTransform xptrans = new XmlDsigXPathTransform();
xptrans.LoadInnerXml(doc.ChildNodes);
refr.AddTransform(xptrans);

<root>
    <a>Some text</a>
    <b attr1="yes" attr2="no"></b>
    <c Id="foo">More text</c>
</root>
<root>
    <a>Some text</a>
    <b attr2="no" attr1="yes" />
    <c Id="foo">More text</c>
</root>

// Adds an KeyInfo element with RSA public key information to the 
// signature. 
// Assumes a SignedXml object in sig, and an RSA object in key.
KeyInfo ki = new KeyInfo();
ki.AddClause(new RSAKeyValue(key));
sig.KeyInfo = ki;

<KeyInfo>
    <KeyValue>
        <RSAKeyValue>
            <Modulus>4LfG(2 lines of Base64 text)2Fr=</Modulus>
            <Exponent>AQAB</Exponent>
        </RSAKeyValue>
    </KeyValue>
</KeyInfo>

// Verify a signature that includes RSAKeyInfo or DSAKeyInfo.
// Assume a SignedXml object in sig.
bool verified = sig.CheckSignature();

<docRoot>
    <a>Hello</a>
    <b>World</b>
    <Signature xmlns="http://www.w3c.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod
                Algorithm="http://www.w3c.org/TR/2001/REC-xml-c14n-20010315"/>
            <SignatureMethod
                Algorithm="http://www.w3c.org/2000/09/xmldsig#rsa-sha1"/>
            <Reference URI="">
                <Transforms>
                    <Transform
                        Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-
                        signature"/>
                    <Transform
                        Algorithm="http://www.w3c.org/TR/1999/REC-xpath-19991116"
                    >
                        <XPath>ancestor-or-self::a</XPath>
                    </Transform>
                </Transforms>
                <DigestMethod
                    Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
                <DigestValue>mN4R0653F4ethOiTBeAu+7q0Be=</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>X4Ie(3 lines of Base64 text)nP3=</SignatureValue>
    </Signature>
</docRoot>

// This method checks the signature profile for the signature
// in the supplied document. It ensures there is only one
// Signature element and only one enveloped reference with only
// one enveloped signature transform
public bool CheckSignatureProfile(XmlDocument doc)
{
    // Make sure there is only one Signature element
    XmlNamespaceManager nsm = new XmlNamespaceManager(new NameTable());
    nsm.AddNamespace("dsig", SignedXml.XmlDsigNamespaceUrl);
    XmlNodeList sigList = doc.SelectNodes("//dsig:Signature", nsm);
    if (sigList.Count > 1)
        return false; //Wrong number of Signature elements

    //Make sure the Signature element has only one Reference
    XmlElement sigElt = (XmlElement)sigList[0];
    XmlNodeList refList = sigElt.SelectNodes(
        "dsig:SignedInfo/dsig:Reference", nsm);
    if (refList.Count > 1)
        return false; //Wrong number of Reference elements

    // Make sure the Reference URI is ""
    XmlElement refElt = (XmlElement)refList[0];
    XmlAttributeCollection refAttrs = refElt.Attributes;
    XmlNode uriAttr = refAttrs.GetNamedItem("URI");
    if ((uriAttr == null) || (uriAttr.Value != ""))
        return false; // Wrong type of reference

    // Make sure the only tranform is the enveloped signature transform
    XmlNodeList transList = refElt.SelectNodes(
        "dsig:Transforms/dsig:Transform", nsm);
    if (transList.Count != 1)
        return false; //Wrong number of Transform elements
    XmlElement transElt = (XmlElement)transList[0];
    string transAlg = transElt.GetAttribute("Algorithm");
    if (transAlg != SignedXml.XmlDsigEnvelopedSignatureTransformUrl)
        return false; //Wrong type of transform

    return true;
}

<root>
    <myData1>Some Data</myData1>
    <myData2>More data</myData2>
    <Signature xmlns="http://www.w3c.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod
                Algorithm="http://www.w3c.org/TR/2001/REC-xml-c14n-20010315"/>
            <SignatureMethod
                Algorithm="http://www.w3c.org/2000/09/xmldsig#rsa-sha1"/>
            <Reference URI="">
                <Transforms>
                    <Transform
                        Algorithm=
                        "http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                </Transforms>
                <DigestMethod
                    Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
                <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
            </Reference>
            <Reference URI="#signer">
                <Transforms>
                    <Transform
                        Algorithm=
                        "http://www.w3c.org/TR/1999/REC-xpath-19991116"
                    >
                        <XPath xmlns:my="http://example">
                            ancestor-or-self::my:SignerID
                        </XPath>
                    </Transform>
                </Transforms>
                <DigestMethod
                    Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
                <DigestValue>mN4R0653F4ethOiTBeAu+7q0Be</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>IoEwS...</SignatureValue>
        <KeyInfo>
            <KeyValue>
                <RSAKeyValue>
                    <Modulus>4LfG(2 lines of Base64 text)2Fr=</Modulus>
                    <Exponent>AQAB</Exponent>
                </RSAKeyValue>
            </KeyValue>
        </KeyInfo>
        <Object Id="signer">
            <my:SignerData xmlns:my="http://example">
                <my:SignerName>Mike</my:SignerName>
                <my:SignerID>4815</my:SignerID>
            </my:SignerData>
        </Object>
    </Signature>
</root>

<docRoot>
    <a>Hello</a>
    <b>World</b>
</docRoot>

<docRoot>
    <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
        xmlns="http://www.w3.org/2001/04/xmlenc#"
    >
        <EncryptionMethod
            Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/> 
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
            <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
                <EncryptionMethod
                    Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> 
                <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <KeyName>recipient_public_key</KeyName> 
                </KeyInfo>
                <CipherData>
                    <CipherValue>PrI6(3 lines of Base64 text)Dwy4=</CipherValue> 
                </CipherData>
            </EncryptedKey>
        </KeyInfo>
        <CipherData>
            <CipherValue>awcH(3 lines of Base64 text)NNqQ=</CipherValue> 
        </CipherData>
    </EncryptedData>
</docRoot>

// Create evidence based on the referring document
Evidence evidence = new Evidence();
evidence.AddHost(new Zone(SecurityZone.Internet));
evidence.AddHost(new Site("untrustedsite"));
evidence.AddHost(new Url("untrustedsite/encrypted.xml"));

EncryptedXml exml = new EncryptedXml(untrustedDoc, evidence);

<order>
    <purchase>
        <item quantity="1">Def Leppard: Pyromania</item>
        <item quantity="1">Ozzy Osbourne: Goodbye to Romance</item>
    </purchase>
    <shipping>
        <to>Shawn Farkas</to>
        <street>One Microsoft Way</street>
        <zip>98052</zip>
    </shipping>
    <payment>
        <card type="visa">0000-0000-0000-0000</card>
    </payment>
</order>

// Assumes the order is in the order.xml file.
XmlDocument doc = new XmlDocument();
doc.Load("order.xml");
EncryptedXml exml = new EncryptedXml(doc);

// Set up the key mapping. Assumes a method called GetBillingKey
// that returns the RSA key for the billing department.
RSA billingKey = GetBillingKey();
exml.AddKeyNameMapping("billing", billingKey);

// Find the element to encrypt.
XmlElement paymentElement = 
    doc.SelectSingleNode("//order/payment") as XmlElement;
// Encrypt the payment element, passing in the key name.
EncryptedData encryptedPayment = 
    exml.Encrypt(paymentElement, "billing");
// Swap the encrypted element for the unencrypted element.
EncryptedXml.ReplaceElement(paymentElement, encryptedPayment, true);

<order>
    <purchase>
        <item quantity="1">Def Leppard: Pyromania</item> 
        <item quantity="1">Ozzy Osbourne: Goodbye to Romance</item> 
    </purchase>
    <shipping>
        <to>Shawn Farkas</to> 
        <street>One Microsoft Way</street> 
        <zip>98052</zip> 
    </shipping>
    <payment>
        <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" 
            xmlns="http://www.w3.org/2001/04/xmlenc#"
        >
            <EncryptionMethod Algorithm="http://www.w3.org/2001/04/
                xmlenc#aes256-cbc" />
            <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
                    <EncryptionMethod Algorithm="http://www.w3.org/2001/04/
                        xmlenc#kw-aes256" />
                    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                        <KeyName>billing</KeyName>
                    </KeyInfo>
                    <CipherData>
                        <CipherValue>
                            Sce6lLD+u2f8HzPFyuGxTF32z4mb2ugql3JuJIPAqIP98iYs+Muhqg==
                        </CipherValue>
                    </CipherData>
                </EncryptedKey>
            </KeyInfo>
            <CipherData>
                <CipherValue>FXKC(3 lines of Base64 text)ApqQt</CipherValue>
            </CipherData>
        </EncryptedData>
    </payment>
</order>

// Assumes the encrypted order is in encrypted.xml
XmlDocument doc = new XmlDocument("encrypted.xml");
EncryptedXml exml = new EncryptedXml(doc, documentEvidence);

// Set up the key mapping. Assumes a method called GetBillingKey
// that returns the RSA key for the billing department.
RSA billingKey = GetBillingKey();
exml.AddKeyNameMapping("billing", billingKey);

// Decrypt the encrypted XML in the document
exml.DecryptDocument();

// Use the private key from the certificate. Assumes a SignedXml
// object in sig and an X509CertificateEx object in cert.
sig.SigningKey = cert.PrivateKey;

// Add X.509 certificate info to the KeyInfo element. Assumes a
// SignedXml object in sig and an X509CertificateEx in cert.
KeyInfoX509Data keyInfoX509 = 
    new KeyInfoX509Data(cert, X509IncludeOption.EndCertOnly);
sig.KeyInfo.AddClause(keyInfoX509);

// Check the signature against the cert and verify the cert. Assumes a
// SignedXml object in sig and an X509CertificateEx object in cert.
bool verified = sig.CheckSignature(cert, true);