X3D Security Examples README

These examples show how to use the World Wide Web Consortium (W3C) Security Recommendations for XML Signature and XML Encryption with X3D.

• X3D Resources: Security provides an additional set of security issues and resources.

Example X3D scenes using XML Security

1. HelloWorldSigned.x3d (.html) is digitally signed for authentication purposes. Digital signature elements appear at the end of the X3D scene.
2. HelloWorldEncryptionInput.x3d (.html) is the example X3D scene that gets encrypted.
3. HelloWorldEncryptionResult.xml is the resulting XML document after applying XML encryption.
4. HelloWorldDecrypted.x3d (.html) is the round-trip version that shows successful decryption.
5. HelloWorldSignedEncryptionResult.xml is the resulting XML document after applying XML encryption to the signed version.
6. HelloWorldSignedDecrypted.x3d (.html) is the round-trip version that shows successful decryption, and subsequent verification, of the signed version.

X3D Canonicalization (C14N) was also performed on each of the unsigned .x3d scenes.

These examples are distributed in the Security section of the X3D Basic Examples Archive under an open-source license.

Keystore and keys for testing

An example copy of the X3D-EditKeystore.ks containing encryption and authentication keys is provided in the keystore subdirectory. The Portecle tool produced reports about the keystore contents: X3D-EditKeystoreReport.txt and X3D-EditKeystoreReport.xml.

X3D-Edit places keystore files in the %HOMEPATH%/X3D-Edit/security subdirectory. The password for this keystore is test.

XML Signature (digital authentication) was applied using the example PublicPrivatePair key pair, available as PublicPrivatePair_certificateChain.cer.

XML Encryption and decryption was applied using a single example SecretKey, available as SecretKey_key.b64.

Warning: these keys are only provided for repeatability testing of the example results. Do not use them for your own work since they are publicly available and not secure.

Tools

These examples were produced using the X3D-Edit authoring tool. XML Security functions are provided via a right-click context menu for X3D scenes. A simple keystore management panel is also provided for creating, deleting, importing and exporting various public/private key pairs and secret keys.

• Apache Santuario and Apache XML Security Java (Javadoc).
• Supplementary tool: Portecle is a user-friendly GUI application for creating, managing and examining keystores, keys, certificates, certificate requests, certificate revocation lists and more.

Uniform Resource Locator (URL) for this page is
https://www.web3d.org/x3d/content/examples/Basic/Security/X3dSecurityReadMe.html
Revised 7 January 2023