c# - XMLDSig X509SerialNumber 太大而不是 int，XSD 验证失败

Question

我正在尝试使用 X509 证书创建 XMLDSig。我从 MS ( http://msdn.microsoft.com/en-us/library/system.security.cryptography.xml.x509issuerserial.aspx ) 运行逐字示例，它生成下面的 XML。 XML 的问题在于 X509SerialNumber 字段太长而不能是 int，而 XSD 指定它必须是这样。因此，当我尝试对签名进行 XSD 验证时，它失败了。

我得到的错误信息是:' http://www.w3.org/2000/09/xmldsig#:X509SerialNumber ' 元素无效 - 根据其数据类型 'http://www.w3.org/2001/XMLSchema:integer，值 '72620403068401703770138453672807553309' 无效' - 字符串 '72620403068401703770138453672807553309' 不是有效的整数值。

如何获得 X509SerialNumber 的正确值？

提前致谢!

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
  <SignedInfo>
    <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
    <Reference URI="">
      <Transforms>
        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
      </Transforms>
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
      <DigestValue>zSI5ZAMmQ+8u7R2rP7aAPT6nNQw=</DigestValue>
    </Reference>
  </SignedInfo>
  <SignatureValue>Tx4rqqDae4vdi5sTjARf0AlBiIGWnx2D8ET+ogGD9FtjrX4ZuYlsOG03Zk5KPKDpC/T45XlWaZpZdCtvAWtv0zwL1/jXxlU2BomQFNXm7rb9YoqlTh8nISStiZKizhmMQynW6GRsXGIpkK37Hnip4c8H1U+eSC/taKW4oyUmg40W64+ZyntovpBt2GqIJQu4AFvMfiF2azV9pg/qZ7IYNOgwmrUG6F0t2RhT2hqR9YRePjrfyIebZvYrLwjTQPXGOzzc2utRILAEhzGNSqsvpf5YeVrmuX75E8Zs3JuaicXu4mgDPYxNNVE2membNQMl6ggllfFjxPnvIofbb/KJ4Q==</SignatureValue>
  <KeyInfo>
    <X509Data>
      <X509IssuerSerial>
        <X509IssuerName>CN=XMLDSIG_Test</X509IssuerName>
        <X509SerialNumber>72620403068401703770138453672807553309</X509SerialNumber>
      </X509IssuerSerial>
      <X509Certificate>MIIDIDCCAgygAwIBAgIQNqIuTm7QSrZClm5/JrLZHTAJBgUrDgMCHQUAMCMxITAfBgNVBAMeGABYAE0ATABEAFMASQBHAF8AVABlAHMAdDAeFw0xMDAxMDEwNjAwMDBaFw0yMDAxMDEwNjAwMDBaMCMxITAfBgNVBAMeGABYAE0ATABEAFMASQBHAF8AVABlAHMAdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMl9hSOn53/2W2//EC8HUgwO7Hwpqx0/yTwth0w3amefwZcfu/+7k9rB+mnviCy6G/9uGzb0Mld+L3RVXisAx9zr2l6LVFjzImY1alwZ01z6AiDdllFPqO7BoSJSozMh0k+vdVQYR3lvgLNyKxXmrTayIWhioQeteIo6HuChz8HI/DNdzoO8axGbLuhy34pogG1gAQr3pTn16Pkd4Mu02KoRz90dryt09wuAk1P/jsePYHBeLQeJSLGojWp1sqypxr25FQiqJantyVLXRRmv7IauTTThSSNrREMcTzbpCx7B4tvyocNwGZysYcdJVsyjbxJRLqutQDlID6QykqkL9O8CAwEAAaNYMFYwVAYDVR0BBE0wS4AQ0N2edJbnLN9AE7hLcICPNaElMCMxITAfBgNVBAMeGABYAE0ATABEAFMASQBHAF8AVABlAHMAdIIQNqIuTm7QSrZClm5/JrLZHTAJBgUrDgMCHQUAA4IBAQC5Nf5SGjqIzQqVnwJbP22RqSHrITAPlymGYfP/qST8Q9V5h5aX8idcGMt3lShUbexXAlKcpQLO4ZzUrjjP3H5Jc659sRSDaeqHGXE0ZMTJpvwA871WH/sGZ8tB7/yuHVsP9hPTImwwDCWx9mYDz8LxpvK11beq/tEilZQxLTvMP0MuT5A6YdCcCc4GkeDV0KVFF+VLEO8OkaWDVXUNMe/AJBHrXuHbQPrUb7s67FKH+b/2GVjBBkM6YI9JtL/A96Y2uf6drhOz6C7wfky2XQOe/7v87/YGEshObBawBA1/OB1AVa+A2WVOosisEGi7iJqszQTdF6TLqGB5eDsiZCH2</X509Certificate>
    </X509Data>
  </KeyInfo>
</Signature>

我正在使用来自以下 URL 的 XSD:

http://www.w3.org/2000/09/xmldsig#

这是我验证 XSD 的代码:

    XmlElement xmlDigitalSignature = signedXml.GetXml();

    var xEl = XElement.Parse(xmlDigitalSignature.OuterXml);
    var xDoc = XDocument.Load(xEl.CreateReader());

    XSDValidator.ValidateSignature(xDoc);


public class XSDValidator
{
    public static void ValidateSignature(XDocument document)
    {
        var schemaSet = new XmlSchemaSet();
        var assm = Assembly.GetExecutingAssembly();
        using (var stream = assm.GetManifestResourceStream("JayTest1.XMLSignature.xsd"))
        {
            schemaSet.Add(XmlSchema.Read(stream, null));
        }
        var isValid = true;
        string errorMessage = null;

        document.Validate(schemaSet, (o, e) =>
        {
            errorMessage = e.Message;
            isValid = false;
        });
        if (!isValid)
        {
            Console.WriteLine("XSD is not valid: " + errorMessage);
        }
        else
        {
            Console.WriteLine("GOOD!");
        }
    }
}

Answer 1

根据 RFC 5280 序列号应该包含长整数:

Certificate users MUST be able to handle serialNumber values up to 20 octets. Conforming CAs MUST NOT use serialNumber values longer than 20 octets.

(关于序列号的第 4.1.2.2 节)

您的序列号 7262040306 8401703770 1384536728 07553309 只有 38 位数字，即使它们是十六进制数字也很容易构成一个 20 字节长整数的数字。

在XML Signature Syntax and Processing (Second Edition) (和 schema file )元素 X509SerialNumber 定义为

<element name="X509SerialNumber" type="integer"/>

根据 integer 的定义，它允许任意整数值:

integer is derived from decimal by fixing the value of fractionDigits to be 0. This results in the standard mathematical concept of the integer numbers. The value space of integer is the infinite set {...,-2,-1,0,1,2,...}. The base type of integer is decimal.

(XML Schema Part 2: Datatypes 的第 3.3.13 节)

因此，您可能需要检查架构文件或 XSD 验证器。

编辑

虽然您的代码基于 XML-Signature Syntax and Processing而不是 XML Signature Syntax and Processing (Second Edition)正如我的回答，这没有什么区别，因为在这两种情况下，X509SerialNumber 都被定义为 integer，没有进一步的限制。

因此，这是您的验证器的问题。我不知道这是错误还是仅仅是一些配置或自定义问题。