ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
XML signature validation in AIR
The identityStatus property
Adobe AIR 1.5 and later
The identityStatus property reports the status of the signing certificate. The value of this property depends on
several factors including:
the cryptographic integrity of the certificate
whether the certificate is expired or revoked
whether the certificate is trusted on the current machine
the state of the XMLSignatureValidator object (such as whether additional certificates have been added for building
the trust chain, whether those certificates are trusted, and the values of the useSystemTrustStore and
revocationCheckSettings properties)
The identityStatus property can have the following values:
valid — To be considered valid, the signing certificate must meet the following conditions:
The signing certificate must be unaltered.
The signing certificate must not be expired or revoked—except when a valid timestamp is present in the
signature. If the signature is timestamped, the certificate will be considered valid as long as it was valid at the
time the document was signed. (The certificate used by the timestamp service to sign the timestamp must chain
to a trusted root certificate on the user’s computer.)
The signing certificate is trusted. A certificate is trusted if the certificate is in the system trust store or chains to
another certificate in the system trust store and you set the useSystemTrustStore property to true. You can
also designate a certificate as trusted using the addCertificate() method of the XMLSignatureValidator
object.
The certificate is, in fact, the signing certificate.
invalid — The certificate is expired or revoked—and no timestamp proving validity at the time of signing is
present—or the certificate has been altered.
unknown — If the certificate is not invalid, but is not trusted either. Self-signed certificates, for example, will be
reported as unknown (unless explicitly trusted). The identityStatus is also reported as unknown if the verify()
method has not completed without error or if the identity has not been checked because the signature digest is
invalid.
The referencesStatus property
Adobe AIR 1.5 and later
The referencesStatus property reports the cryptographic integrity of the references in the SignedData element of
the signature.
valid — If the computed digest of every reference in the signature matches the corresponding digest recorded in
the XML signature. A valid status indicates that the signed data has not been altered.
invalid — If any computed digest does not match the corresponding digest in the signature.
unknown — If the reference digests have not been checked. The references are not checked if the overall signature
digest is invalid or the signing certificate is invalid. If the identityStatus is unknown, then the references are
only checked when the referencesValidationSetting is validOrUnknown.
Last updated 6/6/2012
859