ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
XML signature validation in AIR
To rely on a certification authority, the signing certificate must be issued by an authority that is trusted on the
computer upon which the signature is validated. Most operating system manufacturers place the root certificates of a
number of certification authorities into the operating system trust store. Users can also add and remove certificates
from the store.
Even if a certificate is issued by a trusted certification authority, you must still decide whether the certificate belongs
to someone you trust. In many use cases, this decision is passed along to the end-user. For example, when an AIR
application is installed, the AIR installer displays the identifying information from the publisher’s certificate when
asking the user to verify whether they want to install the application. In other cases, you might have to compare the
public key or other certificate information to a list of acceptable keys. (This list must be secured, perhaps by its own
signature, or by storing in the AIR encrypted local store, so that the list itself cannot be tampered with.)
Note: While you can elect to trust the signing certificate without independent verification—such as when a signature is
“self-signed”—you do not thereby gain much assurance of anything by verifying the signature. Without knowing who
created a signature, the assurance that the signature has not been tampered with, is of little, if any, value. The signature
could be a validly signed forgery.
Certificate expiration and revocation
Adobe AIR 1.5 and later
All certificates expire. Certificates can also be revoked by the issuing certification authority if, for example, the private
key related to the certificate is compromised or stolen. If a signature is signed with an expired or revoked certificate,
then the signature will be reported as invalid unless a timestamp has been included as part of the signature. If a
timestamp is present, then the XMLSignatureValidator class will validate the signature as long as the certificate was
valid at the time of signing.
A timestamp is a signed digital message from a timestamp service that certifies that the data was signed at a particular
time and date. Timestamps are issued by timestamp authorities and signed by the timestamp authority’s own
certificate. The timestamp authority certificate embedded in the timestamp must be trusted on the current machine
for the timestamp to be considered valid. The XMLSignatureValidator does not provide an API for designating a
different certificate to use in validating the timestamp.
Implementing the IURIDereferencer interface
Adobe AIR 1.5 and later
To validate an XML signature, you must provide an implementation of the IURIDereferencer interface. The
implementation is responsible for resolving the URIs within the Reference elements of an XML signature document
and returning the data so that the digest can be computed. The computed digest is compared with the digest in the
signature to determine if the referenced data has been altered since the signature was created.
Note: HTML-based AIR applications must import a SWF library containing an ActionScript implementation in order to
validate XML signatures. The IURIDereferencer interface cannot be implemented in JavaScript.
The IURIDerefencer interface has a single method, dereference(uri:String), that must be implemented. The
XMLSignatureValidator object calls this method for each reference in the signature. The method must return the data
in a ByteArray object.
Last updated 6/6/2012
862