XAdES problem - polish KSEF - C++Builder - 5.1.1.9

VCL TMS Cryptography Pack
1

Hello,

We are using your TMS Cryptography Pack for integration with KSeF in Poland.
We successfully implemented everything using version 4.3.3.0 in the C++ Builder 10.2 Tokyo.
Now, we have updated to C++ Builder 13 and TMS Crypto 5.1.1.9, and we are encountering an issue with the TXAdES object.

Our code previously looked like this and used a key file that was already decrypted:

xades->Packaging = enveloping;
xades->KeyFilePath = ExtractFilePath(Application->ExeName) + "KSeF\\klucz.key";
xades->CertFilePath = ExtractFilePath(Application->ExeName) + "KSeF\\certyfikat.crt";
xades->GenerateSignature(ExtractFilePath(Application->ExeName) + "KSeF\\xades.xml", ExtractFilePath(Application->ExeName) + "KSeF\\podpisany.xml");

The code above worked very well but required the key file to be decrypted beforehand.

In the new version of TMS Crypto, it is possible to provide a password and use the original key file. We therefore modified our code as follows:

// xades->Packaging = enveloping;
xades->Packaging = enveloped;
		
// poniżej dodano
xades->PKCS11Param->isToken = false;
xades->Password = "PasswordToKeyFile!";
xades->Template = xPlEnveloped;


xades->KeyFilePath = ExtractFilePath(Application->ExeName) + "KSeF\klucz_org.key";
xades->CertFilePath = ExtractFilePath(Application->ExeName) + "KSeF\\crt_org.crt";
xades->GenerateSignature(ExtractFilePath(Application->ExeName) + "KSeF\\xades.xml", ExtractFilePath(Application->ExeName) + "KSeF\\podpisany.xml");

After this modification, the GenerateSignature() function triggers an Access Violation error.

We found a forum thread discussing this error:
XAdES problem - polish KSEF - C++Builder - 5.1.0.4 - #2 by Bernard

The solution provided there does not work, as the latest version of TMS Crypto does not contain the line:

inherited Create(Self);

Naturally, we are using the original encrypted key file in the new version.

What could be the problem here?

We also have an additional question. Can the new version of TMS Crypto - like the old version 4.3.3.0 - use key files that have already been decrypted? If so, how? Providing an empty password does not work.

Thank you in advance for your help.

2

Hello again,

While waiting for a response, we installed the latest version 5.2.1.0, but that didn't help either.

The debugger indicates that the problem is probably with ParseXMLTreeNs().
The problem only occurs when xades->Packaging is set to enveloped. When xades->Packaging is set to enveloping, the signed XML request is generated, but KSeF either responds with "unreadable content" when xades->Template = xPlEnveloped, or "Invalid root element doc" when xades->Template = xBasic.

We also encountered a problem with RSA, where withOpenSSL was removed. However, we circumvented the problem by retrieving the public key string directly from the PEM certificate file and loading that key as a String into RSA.

We didn't have these issues with version v4.3.3.0.

So, our question is: is it possible to download version v5.0.9.4 somewhere, which, according to the changelog, is identical to version v4.3.3.0 except for added support for Delphi 13 (C++ Builder 13?)?

We would appreciate the opportunity to test our code from version v4.3.3.0 with version v5.0.9.4.

Thank you for your time, and we look forward to your response.

3

Hi Andrzej,

All previous versions should be in your account, product list. If not, I'll will send you a ZIP file.

To investigate your issue, I would need a project. Can you send it to bernard[at]tmssoftware.com?

Regards,

bernard

4

Thank you for your reply.

By September 11th, I'll prepare a fragment of our code that will allow you to test our problem and send it along with the certificate and KSeF test key.

In the meantime, I tried downloading version v5.0.9.4 from the panel, but I still have the options of classic v4.3.3.0 and the latest version.

Can I check this? Maybe a zip file via email would be the best option.

5

Hi Andrzej,

I am surprised with an issue on KSeF between 4.x and 5.x as this option didn't exist back then. There must be something else.

Anyway, I'll send you 5.0.9.4 separately but I need an email address.

Regards,

bernard

6

Thank you. I have forwarded the relevant message from our email inbox to supportcenter@tmssoftware.com.

7

The issue is with the file format. XAdES needs to canonicalize the content and it works much better when the xml nodes are indented with spaces.

<?xml version="1.0" encoding="utf-8"?>

<AuthTokenRequest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://ksef.mf.gov.pl/auth/token/2.0">
  <Challenge>20260909-CR-64F6B79000-ADF3CC93E0-FA</Challenge>
    <ContextIdentifier>
    <Nip>6666666666</Nip>
  </ContextIdentifier>
  <SubjectIdentifierType>certificateSubject</SubjectIdentifierType>
</AuthTokenRequest>

One liners may or may not work, so it is highly recommended to indent nodes.

bernard