Subject: RE: XML Digital Signatures in Atom feeds and entries

From: "Granqvist, Hans" <[email-masked]>
Date: Tue, 5 Sep 2006 09:43:12 -0700

James,

There is an interop service for Atom 1.0 feed/entry signature 
validation available (with source code for both service and 
Wordpress plugin) as part of the Signed Ping initiative at 
  http://signedping.com

Let me know if you need more info.
-Hans 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of James M Snell
> Sent: Monday, September 04, 2006 12:02 PM
> To: atom-syntax
> Subject: XML Digital Signatures in Atom feeds and entries
> 
> 
> I'm currently looking for other Atom implementations that 
> support the option to digitally sign feeds and entries.  
> Apache Abdera supports digital signatures and encryption and 
> I'd like to do some interop testing against other impls.
> 
> - James
> 
> 
>

---

From: James M Snell <[email-masked]>
Date: Tue, 05 Sep 2006 17:50:20 -0700

Thanks Hans,

I've tested Abdera's implementation against the endpoint and the signed
entries validate just fine.  Thanks for having that endpoint up and
running.

For what it's worth, here is how to send a signed ping using Abdera:

  // Initialize the keystore
  KeyStore ks = KeyStore.getInstance(keystoreType);
  InputStream in = Listing11.class.getResourceAsStream(keystoreFile);
  ks.load(in, keystorePass.toCharArray());
  PrivateKey signingKey =
    (PrivateKey) ks.getKey(
      privateKeyAlias,
      privateKeyPass.toCharArray());
  X509Certificate cert =
    (X509Certificate) ks.getCertificate(
      certificateAlias);

  // Create the entry to sign
  Abdera abdera = new Abdera();
  AbderaSecurity absec = new AbderaSecurity(abdera);
  Factory factory = abdera.getFactory();

  Entry entry = factory.newEntry();
  entry.setId("http://example.org/foo/entry");
  entry.setUpdated(new java.util.Date());
  entry.setTitle("This is an entry");
  entry.setContentAsXhtml("This <b>is</b> <i>markup</i>");
  entry.addAuthor("James");
  entry.addLink("http://www.example.org");

  // Prepare the digital signature options
  Signature sig = absec.getSignature();
  SignatureOptions options = sig.getDefaultSignatureOptions();
  options.setCertificate(cert);
  options.setSigningKey(signingKey);

  // Sign the entry
  entry = sig.sign(entry, options);

  // Send the ping
  Client client = new CommonsClient();
  RequestOptions opts = client.getDefaultRequestOptions();
  opts.setContentType("application/xml");
  BaseRequestEntity bre = new BaseRequestEntity(entry,false);
  ClientResponse response = client.post(
    "http://verisignlabs.com/tg/verify", bre, opts);
  if (response.getStatus() == 200) {
    Document<Element> result = response.getDocument();
    writer.writeTo(result, System.out);
  }

- James