This series of articles makes the reader familiar with the problems related to digitally signing documents in Java-based Web applications and suggests specific approaches for their solving. A fully functional, open-source framework is presented for digitally signing documents in the client's Web browsers and verifying signatures, certificates, and certification chains.
Part 1 introduces the basic concepts of digital signatures and PKI (Public Key Infrastructure): public keys, private keys, digital certificates, certification authorities, certification chains, keystores, and so forth.
Part 2 describes the procedures and algorithms for digitally signing documents and digital signature verification.
Part 3 introduces the class libraries for working with digital signatures and certificates on a Java 2 platform and gives a short description of the most important classes and interfaces from Java Cryptography Architecture (JCA) and Java Certification Path API that concern the use of digital signatures and certificates.
Part 4 provides an analysis of the most essential problems connected with the digitally signing of documents in Web-based systems and suggests a particular solution for them. Motivated is the need for using a digitally signed Java applet that is integrated with the Web application and signs the files on the client's machine before uploading them to the server. The problems related to Java applets signing and interoperability between applets and Web browsers are examined. The mechanisms for verification of digital signatures, certificates, and certification chains and the possibilities for their particular application are also discussed and analyzed.
Part 5 proposes the NakovDocumentSigner system to give the developers a fully functional framework for digitally signing documents in the client's Web browsers and verifying signatures, certificates, and certification chains on the server side. The system consists of a Java applet for digitally signing and a reference J2EE Web application for signatures and certificates verification. It demonstrates how the Java Cryptography Architecture and Java Certification Path API can be applied to provide the Web applications with digital signature functionality. The full source code of the framework is included and discussed.
Part 1. Basic Concepts Related to Digital Signatures
When transferring important documents electronically, it is often necessary to certify in a reliable way who is actually the sender (author) of a given document. One approach for certifying the origin of documents and files is by using the so-called digital signature (electronic signature).
The digital signing of documents uses public key cryptography as a mathematical base.
Public Key Cryptography
Public key cryptography is a mathematical science used to provide confidentiality and authenticity in information exchange by using cryptographic algorithms that work with public and private keys. These cryptographic algorithms are used to digitally sign documents, digital signature verification, and document encryption and decryption.
The public and private keys are a mathematically bound cryptographic key pair (public/private key pair). To each public key corresponds exactly one private key and vice versa; to each private key corresponds exactly one public key. To use public key cryptography, one must have a public key and its corresponding private key.
The public key is a number (sequence of bits), which is usually bound to a person. A public key can be used to check digital signatures, created with the corresponding private key, as well as for encrypting documents that can then be decrypted only by the owner of the corresponding private key. The public keys are not secret to anybody and are usually publicly available. The public key of a given person must be known to anyone communicating with the person using public key cryptography.
The private key is a number (sequence of bits), known only to its owner. With his or her private key, a person can sign documents and decrypt documents that are encrypted with the corresponding public key. To a certain extent, the private keys resemble the well-known access passwords, which are a widespread authentication method over the Internet. The similarity is that with the private key, as well with the password, a person can prove his or her identity, i.e. to authenticate himself or herself. In addition, as with the passwords, the private keys are meant to be secret to all but the owner. In contrast to the access passwords, the private keys are not so short to be remembered and therefore their storing requires special care. If a private key falls into the hands of a person not owning the key (that is, if the key is stolen), the whole communication, based on public key cryptography, depending on this private key, becomes meaningless. In such cases, the stolen key must be announced invalid and be substituted to become possible again to communicate securely with the owner of the key.
For its purposes, public key cryptography uses such cryptographic algorithms that it is practically impossible for contemporary mathematics and the current computing machinery to find the private key of a person, knowing his or her public key. In fact, the finding of a private key that corresponds to a given public key is possible in theory, but the necessary time and computing power make such operations meaningless. From a mathematical point of view, it is impossible to sign a document without knowing the private key of the person who signs it. It is also impossible to decrypt a document that was encrypted with the public key of a given person without knowing the corresponding private key. The science dealing with breaking cryptographic keys and codes is called cryptanalysis.
The digital signing is a mechanism for certifying the origin and the integrity of electronically transmitted information. In the process of digitally signing, additional information—called a digital signature—is added to the given document, calculated using the contents of the document and some private key. At a later stage, this information can be used to check the origin of the signed document.
The digital signature is a number (sequence of bits), calculated mathematically when signing a given document (message). This number depends on the contents of the message, the algorithm used for signing, and the private key used to perform the signing. The digital signature allows the recipient to check the actual origin of the information and its integrity.
Silverlight 2 SDK for Visual Studio 2008
Article: What Does it Take to Build the Best RIA? 
Expression Blend 2.5 Preview
The Hottest Mobile Platform Meets the Hottest RIA Platform 
Article: Leveraging Your Flash Development with Silverlight 
IE 7
Firefox 2.0
