Validating the Lotus Forms XML digital signature with Java

Introduction to the Lotus Forms XML digital Signature

This article focuses on verifying the signed Lotus Forms document using the JSR-the API, without relying on the Lotus Forms API (download the source code, see download section). This approach simplifies the process of integrating products purchased from other vendors with Lotus Forms by using standard JAVA™API calls and XML signature implementations from other vendors.

For this article, the form refers to an XML document that contains tags that are described using the extensible Forms Description Language (XFDL), and extensible Forms Description Language (XFDL) is A glossary that uses standard XML format to describe the Lotus Forms document. Within the XFDL form, the user interface control is called an item, and the item uses XML element and attribute encoding. Items are typically bound to data in an XForms instance and are organized as one or more visual pages.

XML signatures are included in the XFDL document, so they are encapsulated signatures. According to the Model-view-controller (MVC) concept, an XML digital signature is part of the data model in an XForms instance, because the generation of digital signatures is an information creation behavior that is done by users with private keys. After the signature is generated, any modifications to the XFDL document will cause signature verification to fail. XML signatures can also selectively ignore parts of a signed document so that multi-step workflows can perform operations on these neglected parts without affecting the validity of digital signatures. The two advantages of this arrangement are that multiple-step signatures are allowed for forms, and signatures can overlap each other.

Listing 1 shows an example of an XML signature in the XForms model. Note that the name space URI of the XForms, DS, and dsxp is defined in the form's <XFDL> document element, and is not shown here. The complete form sample can be found in the download section.

Listing 1. XForms instance containing unsigned XML signature


<xforms:model>


<xforms:instance xmlns= "" id= "generated" >


<data>


<page1>


<customer>


<firstname1>John</firstname1>


<middlename1>M</middlename1>


<lastname1>Smith</lastname1>


<ssn1>123456789</ssn1>


<streetaddress1>1000 Main street</streetaddress1>


<city1>La</city1>


<state>California</state>


<zipcode>10080</zipcode>


<gender1>M</gender1>


<dateofbirth1>1980-01-02</dateofbirth1>


<workphone1>1001234567</workphone1>


<homephone1>1001236789</homephone1>


</customer>


<signature1>


<ds:Signature>


<ds:SignedInfo>


<ds:canonicalizationmethod algorithm= "http://www.w3.org/TR/2001/


rec-xml-c14n-20010315 "></ds:CanonicalizationMethod>


<ds:signaturemethod algorithm= "http://www.w3.org/2000/09/xmldsig#


rsa-sha1 "></ds:SignatureMethod>


<ds:Reference>


<ds:Transforms>


<ds:transform algorithm= "http://www.w3.org/2002/06/


Xmldsig-filter2 ">


<dsxp:xpath filter= "Subtract" >/xfdl:xfdl/xfdl:globalpage/


xfdl:global/xfdl:xformsmodels/xforms:model[1]/


xforms:instance [@id = "generated"]/data/page1/signature1/


ds:signature


</dsxp:XPath>


</ds:Transform>


</ds:Transforms>


<ds:digestmethod algorithm= "http://www.w3.org/2000/09/xmldsig#


SHA1 "></ds:DigestMethod>


<ds:DigestValue></ds:DigestValue>


</ds:Reference>


<ds:reference uri= "" >


<ds:Transforms>


<ds:transform algorithm= "http://www.w3.org/2002/06/


Xmldsig-filter2 ">


<dsxp:xpath filter= "intersect" >here ()/ancestor::


Ds:signature[1]/ds:object [sigmeta:metadata]</dsxp:xpath>


</ds:Transform>


</ds:Transforms>


<ds:digestmethod algorithm= "http://www.w3.org/2000/09/xmldsig#


SHA1 "></ds:DigestMethod>


<ds:DigestValue></ds:DigestValue>


</ds:Reference>


</ds:SignedInfo>


<ds:SignatureValue></ds:SignatureValue>


<ds:Object>


<sigmeta:metadata>


<sigmeta:timestamp>


<sigmeta:signtime></sigmeta:signtime>


<sigmeta:dst></sigmeta:dst>


<sigmeta:date></sigmeta:date>


</sigmeta:timestamp>


</sigmeta:metadata>


</ds:Object>


</ds:Signature>


</signature1>


</page1>


</data>


</xforms:instance>


</xforms:model>