West Pomeranian University of Technology in Szczecin Concept

West Pomeranian University of Technology in Szczecin Concept of an electronic form based on XML that ensures a high level of interoperability and security Profesor Imed El Fray, BEng, MSc, Ph. D, DSc Profesor Alexander Prokopenya, BEng, MSc, Ph. D, DSc Gerard Wawrzyniak BEng, MSC Mateusz Kłos, BEng, MSC

West Pomeranian University of Technology in Szczecin Transaction – information - document - form Goods Information The exchange of goods (execution of transactions) is always accompanied by the exchange of information The transfer of tangible, intangible goods or services between the parties as a result of the various relationships binding the parties Document (Form): • Data gathering (document) • Data presentation (document) • Automated processing (document) • User interaction (form) • Server interaction (electronic form) • Transaction execution control (electronic form) 1

West Pomeranian University of Technology in Szczecin Heterogeneous, distributed environment of transaction execution 2

West Pomeranian University of Technology in Szczecin High interoperability - XMLd. Sig 3

West Pomeranian University of Technology in Szczecin The concept of advanced electronic form 4

Transaction driven by form logic All parties have undeniable proof of the transaction 6 West Pomeranian University of Technology in Szczecin

Presentation Layer and Data Layer Dynamic component attribute values based on the concept of expressions 5 West Pomeranian University of Technology in Szczecin

West Pomeranian University of Technology in Szczecin XML signature - vulnerabilities • Code injection for transformations (c 14 N, Xpath, XSLT) (c 14 N, XPath, XSLT) • External reference revocation attack (both to external networks and to local resources) • Element wrapping: • The possibility of incorrectly indicated content in a signature reference that is not relevant to the transaction being performed and omits relevant content. • Possibility of modifying the content relevant to the executed transaction without compromising the validity of the signature. • Processing malformed content despite a positive signature verification result. • Incorrect transaction execution 6

West Pomeranian University of Technology in Szczecin XML Signature Wrapping Attack (XSW) 7

West Pomeranian University of Technology in Szczecin vulnerability of references <? xml version="1. 0" encoding="UTF-8"? > <Contract> <Recipient. Signature> <General. Info Id="Gneral. Data"> <ds: Signature xmlns: ds="http: //www. w 3. org/2000/09/xmldsig#" <Supplier Id="Supplier. Data"> Id="Recipient. Signature. Id">. . . <ds: Signed. Info> </Supplier>. . . <Recipient Id="Recipient. Data"> </ds: Signed. Info>. . . <ds: Signature. Value. Id="Recipient. Signature. Value. Id"> </Recipient> K 1 c. Xlt. . . Ebg== </General. Info></ds: Signature. Value> <Delivery Id="Delivery. Data"> <ds: Key. Info>. . . </Delivery> </ds: Key. Info> <Order Id="Order. Data"> </ds: Signature>. . . </Recipient. Signature> </Order> <Payment. Details> <Total>200000</Total> <From. Account> <Account. Number>1234 -4342 -0000 -32342 -35683532</Account. Number> </From. Account> <To. Account> <Account. Number>4532 -0903 -0032 -0943 -95463434</Account. Number> </To. Account> </Payment. Details> <Authorisation> <Recipient. Signature> </Recipient. Signature> <Supplier. Signature> </Authorisation> </Contract> VERIFICATION: 'resources/Supplier. Signature' Document is signed by 2 signatures. VERYFYING SIGNATURE: 0 VERYFYING SIGNATURE: Recipient. Signature. Id Core validity status : true Signature. Value status: true ========================================= Reference[0] Id: 'Recipient. General. Data. Ref' validity status: true URI: '#Gneral. Data' <? xml version="1. 0" encoding="UTF-8"? > Transform: 'http: //www. w 3. org/2000/09/xmldsig#enveloped-signature' Calc <Contract> Digest: ccd 825561 da 14588 cc 079437 b 45 fe 2 c 7291 a 19 f 79 b 3 cd 9 f 50 cf 6112 a 418 e 0805 <Supplier. Signature> <General. Info Id="Gneral. Data"> Expected Digest: ccd 825561 da 14588 cc 079437 b 45 fe 2 c 7291 a 19 f 79 b 3 cd 9 f 50 cf 6112 a 418 e 0805 <ds: Signature xmlns: ds="http: //www. w 3. org/2000/09/xmldsig#" ========================================= Id="Supplier. Signature. Value. Id"><Supplier Id="Supplier. Data"> Reference[1] Id: 'Recipient. Delivery. Ref' validity status: true. . . URI: '' <ds: Signed. Info> </Supplier> Transform: 'http: //www. w 3. org/2002/06/xmldsig-filter 2'. . . <Recipient Id="Recipient. Data"> Calc Digest: c 10389 fb 37 e 9348 cf 4 d 0 cb 069 f 9689771 a 6762 c 3437 cbe 41 f 6 da 184 a 8 ad 2 aa 5 c </ds: Signed. Info>. . . <ds: Signature. Value>TT. . g==</ds: Signature. Value> Expected Digest: c 10389 fb 37 e 9348 cf 4 d 0 cb 069 f 9689771 a 6762 c 3437 cbe 41 f 6 da 184 a 8 ad 2 aa 5 c </Recipient> <ds: Key. Info> ========================================= </General. Info> <ds: Key. Value> Reference[2] Id: 'Recipient. Order. Ref' validity status: true URI: '' <Delivery Id="Delivery. Data">. . . Transform: 'http: //www. w 3. org/2002/06/xmldsig-filter 2'. . . </ds: Key. Value> Calc Digest: 2 bc 0 aa 81 aed 66 ed 7 fe 07 aea 39 ab 052 a 3 ac 436 c 7 ad 547 b 915 d 937 c 07 df 92583 d 8 </Delivery> </ds: Key. Info> Expected Digest: 2 bc 0 aa 81 aed 66 ed 7 fe 07 aea 39 ab 052 a 3 ac 436 c 7 ad 547 b 915 d 937 c 07 df 92583 d 8 <Order Id="Order. Data"> </ds: Signature> =========================================. . . </Supplier. Signature> Reference[3] Id: 'Recipient. Payment. Ref' validity status: true URI: '' </Order> Transform: 'http: //www. w 3. org/2002/06/xmldsig-filter 2' <Payment. Details> Calc Digest: e 3 b 0 c 44298 fc 1 c 149 afbf 4 c 8996 fb 92427 ae 41 e 4649 b 934 ca 495991 b 7852 b 855 <Total>200000</Total> Expected Digest: e 3 b 0 c 44298 fc 1 c 149 afbf 4 c 8996 fb 92427 ae 41 e 4649 b 934 ca 495991 b 7852 b 855 <From. Account> ========================================= <Account. Number>4532 -0903 -0032 -0943 -95463434</Account. Number> Signature passed core validation </From. Account> VERYFYING SIGNATURE: 1 <To. Account> VERYFYING SIGNATURE: Supplier. Signature. Id <Account. Number>1234 -4342 -0000 -32342 -3568 Core validity status : true 3532</Account. Number> Signature. Value status: true </To. Account> ========================================= </Payment. Details> Reference[0] Id: 'Recipient. Signature' validity status: true URI: '' <Authorisation> Transform: 'http: //www. w 3. org/2002/06/xmldsig-filter 2' <Recipient. Signature> Calc Digest: 94 d 26 cb 5 c 02 d 4 e 877 a 289 cfe 094 fbfe 603 a 00793349 b 9 ca 399 d 77879 b 2 ec 8 fce </Recipient. Signature> Expected Digest: 94 d 26 cb 5 c 02 d 4 e 877 a 289 cfe 094 fbfe 603 a 00793349 b 9 ca 399 d 77879 b 2 ec 8 fce <Supplier. Signature> ========================================= </Supplier. Signature> Signature passed core validation </Authorisation> 8 </Contract>

West Pomeranian University of Technology in Szczecin Problem source <? xml version="1. 0" encoding="UTF-8"? > <Contract> <ds: Reference Id="Recipient. Payment. Ref" URI=""> <General. Info Id="Gneral. Data"> <ds: Transforms> <Supplier Id="Supplier. Data"> <ds: Transform Algorithm="http: //www. w 3. org/2002/06/xmldsig-filter 2">. . . <XPath xmlns="http: //www. w 3. org/2002/06/xmldsig-filter 2" </Supplier> Filter="intersect">/Contract/Payment. Detail</XPath> <Recipient Id="Recipient. Data"> </ds: Transform>. . . </ds: Transforms> </Recipient> <ds: Digest. Method Algorithm="http: //www. w 3. org/2001/04/xmlenc#sha 256"/> <ds: Digest. Value>47 DEQpj 8 HBSa+/TIm. W+5 JCeu. Qe. Rkm 5 NMp. JWZG 3 h. Su. FU=</ds: Digest. Value> </General. Info> </ds: Reference> <Delivery Id="Delivery. Data">. . . </Delivery> <Order Id="Order. Data">. . . </Order> <Payment. Details> <Total>200000</Total> <From. Account> <Account. Number>4532 -0903 -0032 -0943 -9546 -3434 </Account. Number> </From. Account> <To. Account> <Account. Number>1234 -4342 -0000 -32342 -3568 -3532 </Account. Number> </To. Account> </Payment. Details> <Authorisation> <Recipient. Signature> </Recipient. Signature> <Supplier. Signature> </Authorisation> </Contract> 9

West Pomeranian University of Technology in Szczecin Prevention - Signature template <? xml version="1. 0" encoding="UTF-8" standalone="no"? > <Signature. Template xmlns: xsi="http: //www. w 3. org/2001/XMLSchema-instance" xsi: no. Namespace. Schema. Location=". . . Signature. Template. xsd"> <Signature canonicalization. Method="INCLUSIVE_WITH_COMMENTS" signature. Id="Recipient. Signature. Value. Id" signature. Method="RSA_SHA 256" value. Id="Recipient. Signature. Value. Id" x. Path="/Contract/Authorisation/Recipient. Signature"> <References> <Id. Reference Id="Recipient. General. Data. Ref" digest. Method="SHA 256„ element. Id="Gneral. Data"/> <Detached Id="Detached. Ref. Id" URI="http: //www. w 3. org/TR/xml-stylesheet" digest. Method="SHA 256"/> <XPath. Filter 2 Id="Recipient. Delivery. Ref" digest. Method="SHA 256"> <XPath expression="/Contract/Delivery" type="intersect"/> </XPath. Filter 2> <XPath. Filter 2 Id="Recipient. Order. Ref" digest. Method="SHA 256"> <XPath expression="/Contract/Order" type="intersect"/> </XPath. Filter 2> <XPath. Filter 2 Id="Recipient. Payment. Ref" digest. Method="SHA 256"> <XPath expression="/Contract/Payment. Details" type="intersect"/> </XPath. Filter 2> </References> </Signature> <Authorization> <ds: Signature xmlns: ds="http: //www. w 3. org/2000/09/xmldsig#" Id="Authorization. Signature"> <ds: Signed. Info/> <ds: Signature. Value>a. YDKJ 1+YJ 6 Q==</ds: Signature. Value> <ds: Key. Info/> </ds: Signature> </Authorization> </Signature. Template> 10

West Pomeranian University of Technology in Szczecin Correct verification <ds: Reference Id="Recipient. Payment. Ref" URI=""> <? xml version="1. 0" encoding="UTF-8"? > <ds: Transforms> <Contract> <ds: Transform Algorithm="http: //www. w 3. org/2002/06/xmldsig-filter 2"> <General. Info Id="Gneral. Data"> <XPath xmlns="http: //www. w 3. org/2002/06/xmldsig-filter 2" <Supplier Id="Supplier. Data"> Filter="intersect">/Contract/Payment. Detail</XPath>. . . </ds: Transform> </Supplier> </ds: Transforms> <Recipient Id="Recipient. Data"> <ds: Digest. Method Algorithm="http: //www. w 3. org/2001/04/xmlenc#sha 256"/>. . . <ds: Digest. Value>47 DEQpj 8 HBSa+/TIm. W+5 JCeu. Qe. Rkm 5 NMp. JWZG 3 h. Su. FU=</ds: Digest. Value> </Recipient> </ds: Reference> </General. Info> <Delivery Id="Delivery. Data">. . . </Delivery> <Order Id="Order. Data">. . . </Order> <Payment. Details> <Total>200000</Total> <From. Account> <Account. Number>4532 -0903 -0032 -0943 -95463434</Account. Number> </From. Account> <To. Account> <Account. Number>1234 -4342 -0000 -32342 -35683532</Account. Number> </To. Account> </Payment. Details> <Authorisation> <Recipient. Signature> </Recipient. Signature> <Supplier. Signature> </Authorisation> </Contract> DOCUMENT TO VERIFY: 'resources/Final. Contract. Recipient. xml' TEMPLATE: 'resources/Recipient. Template-SIGNED. xml' VERYFYING SIGNATURE: Recipient. Signature. Value. Id Core validity status : true Signature. Value status: true ========================================= Reference[0] Id: 'Recipient. General. Data. Ref URI: '#Gneral. Data' Calc Digest: ccd 825561 da 14588 cc 079437 b 45 fe 2 c 7291 a 19 f 79 b 3 cd 9 f 50 cf 6112 a 418 e 0805 Expected Digest: ccd 825561 da 14588 cc 079437 b 45 fe 2 c 7291 a 19 f 79 b 3 cd 9 f 50 cf 6112 a 418 e 0805 External Digest: ccd 825561 da 14588 cc 079437 b 45 fe 2 c 7291 a 19 f 79 b 3 cd 9 f 50 cf 6112 a 418 e 0805 Validity status: true Reference status: true ========================================= Reference[1] Id: 'Detached. Ref. Id URI: 'http: //www. w 3. org/TR/xml-stylesheet' Calc Digest: a 10073 dc 864 ee 7 ec 9 eebbd 35485 edf 87 b 3 b 9136 f 305 ff 80711 f 48 b 817 ad 5 fb 6 e Expected Digest: a 10073 dc 864 ee 7 ec 9 eebbd 35485 edf 87 b 3 b 9136 f 305 ff 80711 f 48 b 817 ad 5 fb 6 e External Digest: a 10073 dc 864 ee 7 ec 9 eebbd 35485 edf 87 b 3 b 9136 f 305 ff 80711 f 48 b 817 ad 5 fb 6 e Validity status: true Reference status: true ========================================= Reference[2] Id: 'Recipient. Delivery. Ref URI: '' Calc Digest: c 10389 fb 37 e 9348 cf 4 d 0 cb 069 f 9689771 a 6762 c 3437 cbe 41 f 6 da 184 a 8 ad 2 aa 5 c Expected Digest: c 10389 fb 37 e 9348 cf 4 d 0 cb 069 f 9689771 a 6762 c 3437 cbe 41 f 6 da 184 a 8 ad 2 aa 5 c External Digest: c 10389 fb 37 e 9348 cf 4 d 0 cb 069 f 9689771 a 6762 c 3437 cbe 41 f 6 da 184 a 8 ad 2 aa 5 c Validity status: true Reference status: true ========================================= Reference[3] Id: 'Recipient. Order. Ref URI: '' Calc Digest: 2 bc 0 aa 81 aed 66 ed 7 fe 07 aea 39 ab 052 a 3 ac 436 c 7 ad 547 b 915 d 937 c 07 df 92583 d 8 Expected Digest: 2 bc 0 aa 81 aed 66 ed 7 fe 07 aea 39 ab 052 a 3 ac 436 c 7 ad 547 b 915 d 937 c 07 df 92583 d 8 External Digest: 2 bc 0 aa 81 aed 66 ed 7 fe 07 aea 39 ab 052 a 3 ac 436 c 7 ad 547 b 915 d 937 c 07 df 92583 d 8 Validity status: true Reference status: true ========================================= Reference[4] Id: 'Recipient. Payment. Ref URI: '' Calc Digest: e 3 b 0 c 44298 fc 1 c 149 afbf 4 c 8996 fb 92427 ae 41 e 4649 b 934 ca 495991 b 7852 b 855 Expected Digest: e 3 b 0 c 44298 fc 1 c 149 afbf 4 c 8996 fb 92427 ae 41 e 4649 b 934 ca 495991 b 7852 b 855 External Digest: 9 ee 1 bf 17 df 8 f 5 d 14141 bc 887 f 093 bfdd 21 f 3 e 4704 ceba 09 dccbf 661988248 f 87 Validity status: true Reference status: false ========================================= Signature passed core validation 11 Signature failed reference content validation

West Pomeranian University of Technology in Szczecin Electronic form standard signature verification 12

West Pomeranian University of Technology in Szczecin Electronic form signature verification using „Signature Template” 13

West Pomeranian University of Technology in Szczecin Form controlling a transaction in a heterogeneous environment 14

West Pomeranian University of Technology in Szczecin Form controlling a transaction in a heterogeneous environment and integrated with distributed registers Without server infrastructure 15

West Pomeranian University of Technology in Szczecin Transaction control form in heterogeneous environment and integrated with any technologies 18

West Pomeranian University of Technology in Szczecin Summary • XML-based electronic forms with a logic layer: • Provide a high level of interoperability • They can be used both by humans and processed automatically • Enable the use of the logic layer to control the execution of transactions • Use of XML signature (XMLd. Sig): • Enables placing in the form (document) many signatures and each of them can sign different fragments of the document • Form signature system improves security by eliminating basic XSW attack threats • Signature templates in forms eliminate the vulnerability of lack of control over signature references, i. e. , lack of control over indication of signed content 16

Thank you Please ask questions West Pomeranian University of Technology in Szczecin