XML Signature XML Signature defines an XML syntax for digital signatures and is defined in the W3C recommendation . Functionally, it has much in common with PKCS#7 but is more extensible and geared towards signing XML documents. It is used by various Web technologies such as SOAP , SAML , and others. XML signatures can be used to sign data-a resource -of any type , typically XML documents, but anything that is accessible via a URL can be signed. An XML signature used to sign a resource outside its containing XML document is called a detached signature ; if it is used to sign some part of its containing document, it is called an enveloped signature; if it contains the signed data within itself it is called an enveloping signature.Structure An XML Signature consists of a Signature
element in the http://www.w3.org/2000/09/xmldsig#
namespace. The basic structure is as follows: etc. The SignedInfo
element contains or references the signed data and specifies what algorithms are used. * The SignatureMethod
and CanonicalizationMethod
elements are used by the SignatureValue
element and are included in SignedInfo
to protect them from tampering. * One or more Reference
elements specify the resource being signed by URI reference and any transformations to be applied to the resource prior to signing. ** Transforms
contains the transformations applied to the resource prior to signing. A transformation can be a XPath-expression that selects a defined subset of the document tree. ** DigestMethod
specifies the hash algorithm before applying the hash. ** DigestValue
contains the Base64 encoded result of applying the hash algorithm to the transformed resource defined in the Reference
element attributes. The SignatureValue
element contains the Base64 encoded signature result - the signature generated with the parameters specified in the SignatureMethod
element - of the SignedInfo
element after applying the algorithm specified by the CanonicalizationMethod
. KeyInfo
element optionally allows the signer to provide recipients with the key that validates the signature, usually in the form of one or more X.509 digital certificates . The relying party must identify the key from context if KeyInfo
is not present. The Object
element contains the signed data if this is an enveloping signature .Validation and security considerations When validating an XML Signature, a procedure called Core Validation is followed. Reference Validation: Each Reference
's digest is verified by retrieving the corresponding resource and applying any transforms and then the specified digest method to it. The result is compared to the recorded DigestValue
; if they do not match, validation fails. Signature Validation: The SignedInfo
element is serialized using the canonicalization method specified in CanonicalizationMethod
, the key data is retrieved using KeyInfo
or by other means, and the signature is verified using the method specified in SignatureMethod
. This procedure establishes whether the resources were really signed by the alleged party. However, because of the extensibility of the canonicalization and transform methods, the verifying party must also make sure that what was actually signed or digested is really what was present in the original data, in other words, that the algorithms used there can be trusted not to change the meaning of the signed data. Because the signed document's structure can be tampered with leading to "signature wrapping" attacks, the validation process should also cover XML document structure. Signed element and signature element should be selected using absolute XPath expression, not getElementByName
methods.XML canonicalization The creation of XML Signatures is substantially more complex than the creation of an ordinary digital signature because a given XML Document may have more than one legal serialized representation. For example, whitespace inside an XML Element is not syntactically significant, so that <Elem >
is syntactically identical to <Elem>
. Since the digital signature ensures data integrity , a single-byte difference would cause the signature to vary. Moreover, if an XML document is transferred from computer to computer, the line terminator may be changed from CR to LF to CR LF , etc. A program that digests and validates an XML document may later render the XML document in a different way, e.g. adding excess space between attribute definitions with an element definition, or using relative URLs, or by reordering namespace definitions. Canonical XML is especially important when an XML Signature refers to a remote document, which may be rendered in time-varying ways by an errant remote server . To avoid these problems and guarantee that logically-identical XML documents give identical digital signatures, an XML canonicalization transform is employed when signing XML documents. These algorithms guarantee that semantically-identical documents produce exactly identical serialized representations. Another complication arises because of the way that the default canonicalization algorithm handles namespace declarations; frequently a signed XML document needs to be embedded in another document; in this case the original canonicalization algorithm will not yield the same result as if the document is treated alone. For this reason, the so-called Exclusive Canonicalization , which serializes XML namespace declarations independently of the surrounding XML, was created.Benefits XML Signature is more flexible than other forms of digital signatures such as Pretty Good Privacy and Cryptographic Message Syntax , because it does not operate on binary data , but on the XML Infoset , allowing to work on subsets of the data, having various ways to bind the signature and signed information, and perform transformations. Another core concept is canonicalization, that is to sign only the "essence", eliminating meaningless differences like whitespace and line endings .Issues There are criticisms directed at the architecture of XML security in general , and at the suitability of XML canonicalization in particular as a front end to signing and encrypting XML data due to its complexity, inherent processing requirement, and poor performance characteristics. The argument is that performing XML canonicalization causes excessive latency that is simply too much to overcome for transactional, performance sensitive SOA applications. These issues are being addressed in the . Without proper policy and implementation the use of XML Dsig in SOAP and WS-Security can lead to vulnerabilities, such as XML signature wrapping.Applications An example of applications of XML Signatures:
Popular articles Javier Milei - Argentine libertarian economist, author, radio conductor and public speaker sympathetic to the Austrian School of economic thought. He became widely known for his regular ...Jimmy Carter - American politician, philanthropist, and former farmer who served as the 39th president of the United States from 1977 to 1981. A member of the Democratic Party, he previ...UEFA Euro 2024 - The 2024 UEFA European Football Championship , commonly referred to as UEFA Euro 2024 or simply Euro 2024 , will be the 17th edition of the UEFA European Championship, the quadrennial internationa...Argentina - country located mostly in the southern half of South America. Sharing the bulk of the Southern Cone with Chile to the west, the country is also b...Sam Altman - American entrepreneur, investor, programmer, and blogger. He is the former president of Y Combinator and now the CEO of OpenAI. Early life and education. ...Rosalynn Carter - American who served as First Lady of the United States from 1977 to 1981 as the wife of President Jimmy Carter. For decades, she has been a leading advocate for numerou...Next Argentine presidential election - Next Argentine presidential election - presidential election in Argentina....Popular movies The Hunger Games (film) - 2012 American dystopian action thriller science fiction-adventure film directed by Gary Ross and based on Suzanne Collins’s 2008 novel of the same name. It is the first insta...untitled Captain Marvel sequel - part of Marvel Cinematic Universe....Killers of the Flower Moon (film project) - Killers of the Flower Moon - film project in United States of America. It was presented as drama, detective fiction, thriller. The film project starred Leonardo Dicaprio, Robert De Niro. Director of...Five Nights at Freddy's (film) - Five Nights at Freddy's - film published in 2017 in United States of America. Scenarist of the film - Scott Cawthon....Popular video games Minecraft - sandbox video game developed by Mojang Studios. Created by Markus "Notch" Persson in the Java programming language and released as a public alpha for personal computers in 2...Grand Theft Auto V - 2013 action-adventure game developed by Rockstar North and published by Rockstar Games. It is the first main entry in the Grand Theft Auto series since 2008's Grand Theft ...Roblox - online game platform and game creation system that allows users to program games and play games created by other users. Founded by David Baszucki and Erik Cassel in 2004 and released in...Baldur's Gate III - upcoming role-playing video game developed and published by Larian Studios for Microsoft Windows and the Stadia streaming service. It is the third main game in the Baldur's ...Alan Wake - action-adventure video game developed by Remedy Entertainment and published by Microsoft Studios, released for the Xbox 360 and Microsoft Windows. The story follows best-selling thri...Fortnite - online video game developed by Epic Games and released in 2017. It is available in three distinct game mode versions that otherwise share the same general gameplay and game engine: ...Super Mario RPG - is a role-playing video game developed by Square and published by Nintendo for the Super Nintendo Entertainment System in 1996. It was directed by Yoshihiko Maekawa and Chihiro Fujioka and produced by...Popular books Book of Revelation - The Book of Revelation is the final book of the New Testament, and consequently is also the final book of the Christian Bible. Its title is derived from the first word of the Koine Greek text: apok...Book of Genesis - account of the creation of the world, the early history of humanity, Israel's ancestors and the origins...Gospel of Matthew - The Gospel According to Matthew is the first book of the New Testament and one of the three synoptic gospels. It tells how Israel's Messiah, rejected and executed in Israel, pronounces judgement on ...Michelin Guide - Michelin Guides are a series of guide books published by the French tyre company Michelin for more than a century. The term normally refers to the annually published Michelin Red Guide , the oldest...Psalms - The Book of Psalms , commonly referred to simply as Psalms , the Psalter or "the Psalms", is the first book of the Ketuvim , the third section of the Hebrew Bible, and thus a book of th...Ecclesiastes - Ecclesiastes is one of 24 books of the Tanakh , where it is classified as one of the Ketuvim . Originally written c. 450–200 BCE, it is also among the canonical Wisdom literature of the Old Tes...The 48 Laws of Power - non-fiction book by American author Robert Greene. The book...Popular television series The Crown (TV series) - historical drama web television series about the reign of Queen Elizabeth II, created and principally written by Peter Morgan, and produced by Left Bank Pictures and Sony Pictures Tel...Friends - American sitcom television series, created by David Crane and Marta Kauffman, which aired on NBC from September 22, 1994, to May 6, 2004, lasting ten seasons. With an ensemble cast sta...Young Sheldon - spin-off prequel to The Big Bang Theory and begins with the character Sheldon...Modern Family - American television mockumentary family sitcom created by Christopher Lloyd and Steven Levitan for the American Broadcasting Company. It ran for eleven seasons, from September 23...Loki (TV series) - upcoming American web television miniseries created for Disney+ by Michael Waldron, based on the Marvel Comics character of the same name. It is set in the Marvel Cinematic Universe, shar...Game of Thrones - American fantasy drama television series created by David Benioff and D. B. Weiss for HBO. It...Shameless (American TV series) - American comedy-drama television series developed by John Wells which debuted on Showtime on January 9, 2011. It...
OWIKI.org . Text is available under the Creative Commons Attribution-ShareAlike License.