Changes

All functions in this module are assigned to the <code>{{Code|http://expath.org/ns/crypto</code> }} namespace, which is statically bound to the <code>{{Code|crypto</code> }} prefix.<br/>All errors are assigned to the <code>{{Code|http://expath.org/ns/error</code> }} namespace, which is statically bound to the <code>{{Code|experr</code> }} prefix.

|<code><b>{{Func|crypto:hmac</b>(|$message as xs:string(), $secret-key as xs:string(), algorithm as xs:string()) as |xs:string()</code>}}<br/><code><b>{{Func|crypto:hmac</b>(|$message as xs:string(), $secret-key as xs:string(), algorithm as xs:string(), $encoding as xs:string()) as |xs:string()</code>}}

<code>{{Code|$encoding</code> }} must either be <code>{{Code|hex</code>}}, <code>{{Code|base64</code> }} or the empty string and specifies the encoding of the returned authentication code. <b>Default is <code>{{Code|base64</code>}}</b>.<br/><code>{{Code|$algorithm</code> }} describes the hash algorithm which is used for encryption. Currently supported are <code>{{Code|md5</code>}}, <code>{{Code|sha1</code>}}, <code>{{Code|sha256</code>}}, <code>{{Code|sha384</code>}}, <code>{{Code|sha512</code>}}. <b>Default is <code>{{Code|md5</code>}}</b>.

* Cryptographic algorithms are currently limited to <code>{{Code|symmetric</code> }} algorithms only. This means that the same secret key is used for encryption and decryption. * Available algorithms are <code>{{Code|DES</code> }} and <code>{{Code|AES</code>}}.* Padding is fixed to <code>{{Code|PKCS5Padding</code>}}.

* As the IV has to be passed along with the encrypted message somehow, data which has been encrypted by the <code>{{Code|crypto:encrypt</code> }} function in BaseX can only be decrypted by calling the <code>{{Code|crypto:decrypt</code> }} function.

|<code><b>{{Func|crypto:encrypt</b>(|$input as xs:string(), $encryption-type as xs:string(), $secret-key as xs:string(), $cryptographic-algorithm as xs:string()) as |xs:string()</code>}}

<code>{{Code|$encryption-type</code> }} must be <code>{{Code|symmetric</code>}}, as asymmetric encryption is not supported so far. <b>Default is <code>{{Code|symmetric</code>}}</b>.<br/><code>{{Code|$secret-key</code> }} is the secret key which is used for both encryption and decryption of input data. Its length is fixed and depends on the chosen algorithm: <code>{{Code|8 bytes for DES</code>}}, <code>{{Code|16 bytes for AES</code>}}.<br/><code>{{Code|$cryptographic-algorithm</code> }} must either be <code>{{Code|DES</code> }} or <code>{{Code|AES</code>}}. Other algorithms are not supported so far, but, of course, can be added on demand. <b>Default is <code>{{Code|DES</code>}}</b>.

|<code><b>{{Func|crypto:decrypt</b>(|$input as xs:string(), $decryption-type as xs:string(), $secret-key as xs:string(), $cryptographic-algorithm as xs:string()) as |xs:string()</code>}}

|Decrypts the encrypted <code>{{Code|$input</code>}}.<br/><code>{{Code|$decryption-type</code> }} must be <code>{{Code|symmetric</code>}}. An option for asymmetric encryption will most likely be added with another version of BaseX. <b>Default is <code>{{Code|symmetric</code>}}</b>.<br/><code>{{Code|$secret-key</code> }} is the secret key which is used for both encryption and decryption of input data. Its length is fixed and depends on the chosen algorithm: <code>{{Code|8 bytes for DES</code>}}, <code>{{Code|16 bytes for AES</code>}}.<br/><code>{{Code|$cryptographic-algorithm</code> }} must either be <code>{{Code|DES</code> }} or <code>{{Code|AES</code>}}. Other algorithms are not supported so far, but, of course, can be added on demand. <b>Default is <code>{{Code|DES</code>}}</b>.

* '''SignatureValue''' contains the Base64 encoded value of the encrypted digest of the <code>{{Code|SignedInfo</code> }} element

* '''Object''' contains the node which is signed if the signature is of type <code>{{Code|enveloping</code>}}

Depending on the signature type, the <code>{{Code|signature</code> }} element is either placed as a child of the signed node (<code>{{Code|enveloped</code> }} type), or directly contains the signed node (<code>{{Code|enveloping</code> }} type). <code>{{Code|Detached</code> }} signatures are so far not supported.

The <code>{{Code|generate-signature</code> }} function allows to pass a <code>{{Code|digital certificate</code>}}. This certificate holds parameters that allow to access key information stored in a Java key store which is then used to sign the input document. Passing a <code>{{Code|digital certificate</code> }} simply helps re-using the same key pair to sign and validate data. The <code>{{Code|digital certificate</code> }} is passed as a node and has the following form:

|<code><b>{{Func|crypto:generate-signature</b>(|$input-doc node(), $canonicalization-algorithm as xs:string(), $digest-algorithm as xs:string(), $signature-algorithm as xs:string(), $signature-namespace-prefix as xs:string(), $signature-type as xs:string()) as |node()</code>}}<br/><code><b>{{Func|crypto:generate-signature</b>(|$input-doc node(), $canonicalization-algorithm as xs:string(), $digest-algorithm as xs:string(), $signature-algorithm as xs:string(), $signature-namespace-prefix as xs:string(), $signature-type as xs:string(), $xpath-expression as xs:string()) as |node()</code>}}<br/><code><b>{{Func|crypto:generate-signature</b>(|$input-doc node(), $canonicalization-algorithm as xs:string(), $digest-algorithm as xs:string(), $signature-algorithm as xs:string(), $signature-namespace-prefix as xs:string(), $signature-type as xs:string(), $digital-certificate as node()) as |node()</code>}}<br/><code><b>{{Func|crypto:generate-signature</b>(|$input-doc node(), $canonicalization-algorithm as xs:string(), $digest-algorithm as xs:string(), $signature-algorithm as xs:string(), $signature-namespace-prefix as xs:string(), $signature-type as xs:string(), $xpath-expression as xs:string(), $digital-certificate as node()) as |node()</code>}}

|<code>{{Code|$canonicalization-algorithm</code> }} must either be <code>{{Code|inclusive-with-comments</code>}}, <code>{{Code|inclusive</code>}}, <code>{{Code|exclusive-with-comments</code> }} or <code>{{Code|exclusive</code>}}. <b>Default is <code>{{Code|inclusive-with-comments</code>}}</b>.<br/><code>{{Code|$digest-algorithm</code> }} must be one of the following: <code>{{Code|SHA1</code>}}, <code>{{Code|SHA256</code> }} or <code>{{Code|SHA512</code>}}. <b>Default is <code>{{Code|SHA1</code>}}</b>.<br/><code>{{Code|$signature-algorithm</code> }} must either be <code>{{Code|RSA_SHA1</code> }} or <code>{{Code|DSA_SHA1</code>}}. <b>Default is <code>{{Code|RSA_SHA1</code>}}</b>.<br/><code>{{Code|$signature-namespace-prefix</code> }} may be empty and prefixes the <code>{{Code|Signature</code> }} element accordingly.<br/><code>{{Code|$signature-type</code> }} must either be <code>{{Code|enveloped</code> }} or <code>{{Code|enveloping</code>}}. Detached signatures are so far not supported. <b>Default is <code>{{Code|enveloped</code>}}</b>.<br/><code>{{Code|$xpath-expression</code> }} is an arbitrary XPath expression which specifies a subset of the document that is to be signed.<br/><code>{{Code|$digital-certificate</code> }} is the digitial certificate used to sign the input document.

<b>[[XQuery Errors#Cryptographic Functions Errors|FOCX0004]]</b> is raised if the <code>{{Code|$xpath-expression</code> }} is invalid.<br/><b>[[XQuery Errors#Cryptographic Functions Errors|FOCX0005]]</b> is raised if the root name of <code>{{Code|$digital-certificate</code> }} is not 'digital-certificate.<br/>

|<code><b>{{Func|crypto:validate-signature</b>(|$input-doc as node()) as |xs:boolean()</code>}}

|Checks if the given node contains a <code>{{Code|Signature</code> }} element and whether the signature is valid. In this case <code>{{Code|true</code> }} is returned. If the signature is invalid the function returns <code>{{Code|false</code>}}.

|<code>{{Code|FOCX0001</code>}}

|<code>{{Code|FOCX0002</code>}}

|<code>{{Code|FOCX0003</code>}}

|<code>{{Code|FOCX0004</code>}}

|<code>{{Code|FOCX0005</code>}}

|<code>{{Code|FOCX0006</code>}}

|<code>{{Code|FOCX0007</code>}}

|<code>{{Code|FOCX0008</code>}}

|<code>{{Code|FOCX0009</code>}}

|<code>{{Code|FOCX0010</code>}}

|<code>{{Code|FOCX0011</code>}}

|<code>{{Code|FOCX0012</code>}}

|<code>{{Code|FOCX0013</code>}}

|<code>{{Code|FOCX0014</code>}}

|<code>{{Code|FOCX0015</code>}}

|<code>{{Code|FOCX0016</code>}}

|<code>{{Code|FOCX0017</code>}}

|<code>{{Code|FOCX0018</code>}}

|<code>{{Code|FOCX0019</code>}}

|<code>{{Code|FOCX0020</code>}}

|<code>{{Code|FOCX0021</code>}}

|<code>{{Code|FOCX0023</code>}}

|<code>{{Code|FOCX0024</code>}}

|<code>{{Code|FOCX0025</code>}}

|<code>{{Code|FOCX0026</code>}}

|<code>{{Code|FOCX0027</code>}}

|<code>{{Code|FOCX0028</code>}}