ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
XML signature validation in AIR
}
var base64Encoder:Base64Encoder = new Base64Encoder();
base64Encoder.insertNewLines = false;
base64Encoder.encodeBytes( digest, 0, digest.bytesAvailable );
var digestBase64:String = base64Encoder.toString();
if( digestBase64 == reference.nameSpace::DigestValue )
{
result = result && true;
message += " " + reference.@URI + " verified.\n";
}
else
{
result = false;
message += " ---- " + reference.@URI + " has been modified!\n";
}
base64Encoder.reset();
}
trace( message );
return result;
The function loops through all the references in the Manifest element. For each reference, the SHA256 digest is
computed, encoded in base64 format, and compared to the digest in the manifest. The URIs in an AIR package refer
to paths relative to the application directory. The paths are resolved based on the location of the signature file, which
is always in the META-INF subdirectory within the application directory. Note that the Flex SHA256 class returns the
digest as a string of hexadecimal characters. This string must be converted into a ByteArray containing the bytes
represented by the hexadecimal string.
To use the mx.utils.SHA256 and Base64Encoder classes in Flash CS4, you can either locate and copy these classes into
your application development directory or compile a library SWF containing the classes using the Flex SDK.
Dereferencing URIs in detached signatures referencing external data
Adobe AIR 1.5 and later
When a URI refers to an external resource, the data must be accessed and loaded into a ByteArray object. If the URI
contains an absolute URL, then it is simply a matter of reading a file or requesting a URL. If, as is probably the more
common case, the URI contains to a relative path, then your IURIDereferencer implementation must include a way to
resolve the paths to the signed files.
The following example uses a File object initialized when the dereferencer instance is constructed as the base for
resolving signed files.
Last updated 6/6/2012
868