443:, allowing to work on subsets of the data (this is also possible with binary data in non-standard ways, for example encoding blocks of binary data in base64 ASCII), having various ways to bind the signature and signed information, and perform transformations. Another core concept is canonicalization, that is to sign only the "essence", eliminating meaningless differences like whitespace and line endings.
410:
Another complication arises because of the way that the default canonicalization algorithm handles namespace declarations; frequently a signed XML document needs to be embedded in another document; in this case the original canonicalization algorithm will not yield the same result as if the document
391:
may be changed from CR to LF to CR LF, etc. A program that digests and validates an XML document may later render the XML document in a different way, e.g. adding excess space between attribute definitions with an element definition, or using relative (vs. absolute) URLs, or by reordering namespace
351:
This procedure establishes whether the resources were really signed by the alleged party. However, because of the extensibility of the canonicalization and transform methods, the verifying party must also make sure that what was actually signed or digested is really what was present in the original
451:
There are criticisms directed at the architecture of XML security in general, and at the suitability of XML canonicalization in particular as a front end to signing and encrypting XML data due to its complexity, inherent processing requirement, and poor performance characteristics. The argument is
355:
Because the signed document's structure can be tampered with leading to "signature wrapping" attacks, the validation process should also cover XML document structure. Signed element and signature element should be selected using absolute
1693:
387:
Since the digital signature ensures data integrity, a single-byte difference would cause the signature to vary. Moreover, if an XML document is transferred from computer to computer, the
376:", in common usage among XML developers) may have more than one legal serialized representation. For example, whitespace inside an XML Element is not syntactically significant, so that
1699:
321:'s digest is verified by retrieving the corresponding resource and applying any transforms and then the specified digest method to it. The result is compared to the recorded
506:
392:
definitions. Canonical XML is especially important when an XML Signature refers to a remote document, which may be rendered in time-varying ways by an errant remote server.
225:
contains the transformations applied to the resource prior to signing. A transformation can be a XPath-expression that selects a defined subset of the document tree.
994:
1004:
407:, a canonicalization is mandatory). These algorithms guarantee that semantically-identical documents produce exactly identical serialized representations.
1551:
1014:
1687:
1285:
828:
466:
Without proper policy and implementation the use of XML Dsig in SOAP and WS-Security can lead to vulnerabilities, such as XML signature wrapping.
372:
The creation of XML Signatures is substantially more complex than the creation of an ordinary digital signature because a given XML Document (an "
710:
1335:
1573:
1361:
999:
452:
that performing XML canonicalization causes excessive latency that is simply too much to overcome for transactional, performance sensitive
278:
element optionally allows the signer to provide recipients with the key that validates the signature, usually in the form of one or more
977:
501:
1418:
1267:
62:
1088:
219:
elements specify the resource being signed by URI reference and any transformations to be applied to the resource prior to signing.
1530:
1024:
1723:
1408:
1175:
982:
735:
1377:
658:
453:
1728:
1499:
1382:
947:
545:
432:
395:
To avoid these problems and guarantee that logically-identical XML documents give identical digital signatures, an XML
821:
516:
1295:
352:
data, in other words, that the algorithms used there can be trusted not to change the meaning of the signed data.
1473:
1277:
957:
915:
868:
855:
837:
1029:
883:
77:
1413:
1310:
1305:
920:
898:
1423:
1217:
814:
1489:
1019:
972:
910:
80:
can be signed. An XML signature used to sign a resource outside its containing XML document is called a
1103:
942:
1648:
1640:
1140:
967:
925:
634:
512:
428:
1664:
1656:
1579:
1449:
1034:
81:
43:
39:
1494:
1632:
1520:
1515:
1076:
578:
497:
564:
1150:
396:
241:
encoded result of applying the hash algorithm to the transformed resource(s) defined in the
1428:
1315:
903:
645:
621:
260:
encoded signature result - the signature generated with the parameters specified in the
1387:
1345:
1130:
893:
752:
534:
193:
element contains or references the signed data and specifies what algorithms are used.
54:
53:
but is more extensible and geared towards signing XML documents. It is used by various
1717:
1227:
1145:
1071:
878:
529:
482:
416:
734:
Juraj
Somorovsky; Andreas Mayer; Jorg Schwenk; Marco Kampmann; Meiko Jensen (2012).
779:
806:
1262:
1113:
1624:
1556:
1525:
1083:
1066:
863:
494:
490:
440:
436:
373:
683:
343:
or by other means, and the signature is verified using the method specified in
1609:
1135:
1093:
1056:
987:
427:
XML Signature is more flexible than other forms of digital signatures such as
282:
digital certificates. The relying party must identify the key from context if
84:; if it is used to sign some part of its containing document, it is called an
1247:
1185:
663:
1197:
1165:
1125:
1061:
873:
800:
591:
88:
signature; if it contains the signed data within itself it is called an
1584:
1340:
1190:
952:
784:
486:
388:
789:
774:
1614:
1535:
1403:
1325:
1207:
1160:
1098:
1051:
962:
696:
335:
element is serialized using the canonicalization method specified in
257:
238:
50:
46:
794:
542:, extensions to XML-DSig for use with advanced electronic signature
1330:
1300:
1290:
1252:
1202:
1180:
1170:
1108:
1046:
1041:
935:
608:"Secure SAML validation to prevent XML signature wrapping attacks"
539:
357:
279:
460:
76:, typically XML documents, but anything that is accessible via a
1320:
1222:
1009:
930:
511:, is required. The electronic signature is legally binding. The
479:
419:
declarations independently of the surrounding XML, was created.
73:
58:
810:
684:
W3C Workshop on Next Steps for XML Signature and XML Encryption
646:
Performance
Comparison of Security Mechanisms for Grid Services
1444:
1257:
1212:
1120:
888:
35:
607:
711:"XML Signature Element Wrapping Attacks and Countermeasures"
785:
Additional XML Security
Uniform Resource Identifiers (URIs)
403:) is employed when signing XML documents (for signing the
293:
element (optional) contains the signed data if this is an
697:"XML Security 2.0 Requirements and Design Considerations"
268:
element after applying the algorithm specified by the
231:
specifies the hash algorithm before applying the hash.
306:
When validating an XML Signature, a procedure called
1680:
1623:
1598:
1566:
1544:
1508:
1482:
1462:
1437:
1396:
1370:
1354:
1276:
1240:
854:
845:
579:"XML Signature Syntax and Processing Version 1.1"
565:"XML Signature Syntax and Processing Version 1.1"
502:Royal National Institute of Chartered Accountants
411:is treated alone. For this reason, the so-called
68:XML signatures can be used to sign data–a
474:An example of applications of XML Signatures:
108:namespace. The basic structure is as follows:
822:
736:"On Breaking SAML: Be Whoever You Want to Be"
8:
49:. Functionally, it has much in common with
1602:
1466:
851:
829:
815:
807:
659:"Accelerate WSS applications with VTD-XML"
325:; if they do not match, validation fails.
459:These issues are being addressed in the
1688:International World Wide Web Conference
556:
302:Validation and security considerations
7:
1362:Web Content Accessibility Guidelines
635:Performance of Web Services Security
601:
599:
775:XML Signature Syntax and Processing
47:XML Signature Syntax and Processing
399:transform (frequently abbreviated
339:, the key data is retrieved using
106:http://www.w3.org/2000/09/xmldsig#
14:
435:, because it does not operate on
16:XML syntax for digital signatures
657:Zhang, Jimmy (January 9, 2007).
1585:Multimodal Interaction Activity
1545:Community & business groups
212:to protect them from tampering.
100:An XML Signature consists of a
803:of how a signature is created.
790:Exclusive XML Canonicalization
592:XML-Signature XPath Filter 2.0
515:standard is part of the Dutch
380:is syntactically identical to
1:
1383:Web Accessibility Initiative
622:"Why XML Security is Broken"
546:Cryptographic Message Syntax
433:Cryptographic Message Syntax
208:element and are included in
1668:(browser/editor, 1996–2012)
517:Standard Business Reporting
1745:
795:XMLSignatures Java binding
461:XML Security Working Group
413:Exclusive Canonicalization
119:<CanonicalizationMethod
1605:
1474:World Wide Web Foundation
1469:
1378:Markup Validation Service
958:Linked Data Notifications
838:World Wide Web Consortium
204:elements are used by the
110:
716:. IBM Research Division
606:Pawel Krawczyk (2013).
1724:Cryptography standards
797:for XMLBeans and JAXB.
337:CanonicalizationMethod
270:CanonicalizationMethod
202:CanonicalizationMethod
42:and is defined in the
329:Signature Validation:
315:Reference Validation:
256:element contains the
57:technologies such as
801:Step-by-Step example
368:XML canonicalization
295:enveloping signature
1729:XML-based standards
478:Digital signing of
429:Pretty Good Privacy
415:, which serializes
245:element attributes.
162:</SignedInfo>
125:<SignatureMethod
1694:Steering Committee
1574:Device Description
1552:Web Advertising BG
500:, approved by the
378:<Elem >
183:</Signature>
165:<SignatureValue
152:</Reference>
116:<SignedInfo>
82:detached signature
44:W3C recommendation
40:digital signatures
1711:
1710:
1676:
1675:
1594:
1593:
1458:
1457:
498:X.509 certificate
264:element - of the
131:<Reference>
113:<Signature>
1736:
1700:First conference
1669:
1661:
1653:
1645:
1637:
1603:
1467:
1450:XHTML+MathML+SVG
869:Activity Streams
852:
831:
824:
817:
808:
763:
762:
760:
759:
749:
743:
742:
740:
731:
725:
724:
722:
721:
715:
707:
701:
700:
693:
687:
681:
675:
674:
672:
671:
654:
648:
643:
637:
632:
626:
625:
618:
612:
611:
603:
594:
589:
583:
582:
575:
569:
568:
561:
510:
406:
397:canonicalization
383:
379:
363:
362:getElementByName
360:expression, not
346:
342:
338:
334:
324:
320:
292:
285:
277:
271:
267:
263:
255:
244:
236:
230:
224:
218:
211:
207:
203:
199:
192:
184:
181:
178:
175:
172:
169:
166:
163:
159:
156:
153:
150:
147:
144:
141:
140:<DigestMethod
138:
135:
132:
129:
126:
123:
120:
117:
114:
107:
103:
1744:
1743:
1739:
1738:
1737:
1735:
1734:
1733:
1714:
1713:
1712:
1707:
1672:
1667:
1659:
1651:
1643:
1635:
1619:
1590:
1562:
1540:
1504:
1478:
1454:
1433:
1392:
1366:
1350:
1316:SMIL Timesheets
1272:
1236:
1141:Information Set
926:Geolocation API
856:Recommendations
847:
841:
835:
771:
766:
757:
755:
753:"SBR Assurance"
751:
750:
746:
738:
733:
732:
728:
719:
717:
713:
709:
708:
704:
695:
694:
690:
682:
678:
669:
667:
656:
655:
651:
644:
640:
633:
629:
620:
619:
615:
605:
604:
597:
590:
586:
577:
576:
572:
563:
562:
558:
554:
526:
504:
472:
449:
425:
404:
389:line terminator
381:
377:
370:
361:
345:SignatureMethod
344:
340:
336:
332:
322:
318:
308:Core Validation
304:
290:
286:is not present.
283:
275:
269:
265:
262:SignatureMethod
261:
253:
242:
234:
228:
222:
216:
209:
205:
201:
198:SignatureMethod
197:
190:
186:
185:
182:
179:
176:
173:
170:
167:
164:
161:
157:
154:
151:
148:
146:<DigestValue
145:
142:
139:
136:
133:
130:
127:
124:
121:
118:
115:
112:
105:
104:element in the
101:
98:
17:
12:
11:
5:
1742:
1740:
1732:
1731:
1726:
1716:
1715:
1709:
1708:
1706:
1705:
1704:
1703:
1702:("WWW1", 1994)
1697:
1684:
1682:
1678:
1677:
1674:
1673:
1671:
1670:
1662:
1654:
1646:
1638:
1629:
1627:
1621:
1620:
1618:
1617:
1612:
1606:
1600:
1596:
1595:
1592:
1591:
1589:
1588:
1582:
1577:
1570:
1568:
1564:
1563:
1561:
1560:
1554:
1548:
1546:
1542:
1541:
1539:
1538:
1533:
1528:
1523:
1518:
1512:
1510:
1509:Working groups
1506:
1505:
1503:
1502:
1497:
1492:
1486:
1484:
1483:Elected groups
1480:
1479:
1477:
1476:
1470:
1464:
1460:
1459:
1456:
1455:
1453:
1452:
1447:
1441:
1439:
1435:
1434:
1432:
1431:
1426:
1421:
1416:
1411:
1406:
1400:
1398:
1394:
1393:
1391:
1390:
1388:Web Components
1385:
1380:
1374:
1372:
1368:
1367:
1365:
1364:
1358:
1356:
1352:
1351:
1349:
1348:
1346:XMLHttpRequest
1343:
1338:
1333:
1328:
1323:
1318:
1313:
1308:
1303:
1298:
1293:
1288:
1282:
1280:
1278:Working drafts
1274:
1273:
1271:
1270:
1265:
1260:
1255:
1250:
1244:
1242:
1238:
1237:
1235:
1234:
1233:
1232:
1231:
1230:
1220:
1215:
1210:
1205:
1200:
1195:
1194:
1193:
1188:
1178:
1173:
1168:
1163:
1158:
1153:
1148:
1143:
1138:
1133:
1128:
1118:
1117:
1116:
1106:
1101:
1096:
1091:
1086:
1081:
1080:
1079:
1069:
1064:
1059:
1054:
1049:
1044:
1039:
1038:
1037:
1035:Filter Effects
1027:
1022:
1017:
1012:
1007:
1002:
997:
992:
991:
990:
980:
975:
970:
965:
960:
955:
950:
945:
940:
939:
938:
928:
923:
918:
913:
908:
907:
906:
901:
896:
886:
881:
876:
871:
866:
860:
858:
849:
843:
842:
836:
834:
833:
826:
819:
811:
805:
804:
798:
792:
787:
782:
777:
770:
769:External links
767:
765:
764:
744:
726:
702:
688:
676:
649:
638:
627:
613:
595:
584:
570:
555:
553:
550:
549:
548:
543:
537:
535:XML Encryption
532:
525:
522:
521:
520:
483:annual reports
471:
468:
456:applications.
448:
445:
424:
421:
369:
366:
349:
348:
326:
303:
300:
299:
298:
287:
273:
254:SignatureValue
250:
249:
248:
247:
246:
232:
226:
213:
206:SignatureValue
134:<Transforms
111:
97:
94:
72:–of any
65:, and others.
15:
13:
10:
9:
6:
4:
3:
2:
1741:
1730:
1727:
1725:
1722:
1721:
1719:
1701:
1698:
1695:
1692:
1691:
1689:
1686:
1685:
1683:
1679:
1666:
1663:
1658:
1655:
1650:
1647:
1642:
1639:
1634:
1631:
1630:
1628:
1626:
1622:
1616:
1613:
1611:
1608:
1607:
1604:
1601:
1597:
1586:
1583:
1581:
1578:
1575:
1572:
1571:
1569:
1567:Closed groups
1565:
1558:
1555:
1553:
1550:
1549:
1547:
1543:
1537:
1534:
1532:
1529:
1527:
1524:
1522:
1519:
1517:
1514:
1513:
1511:
1507:
1501:
1498:
1496:
1493:
1491:
1488:
1487:
1485:
1481:
1475:
1472:
1471:
1468:
1465:
1463:Organizations
1461:
1451:
1448:
1446:
1443:
1442:
1440:
1436:
1430:
1427:
1425:
1422:
1420:
1417:
1415:
1412:
1410:
1407:
1405:
1402:
1401:
1399:
1395:
1389:
1386:
1384:
1381:
1379:
1376:
1375:
1373:
1369:
1363:
1360:
1359:
1357:
1353:
1347:
1344:
1342:
1339:
1337:
1334:
1332:
1329:
1327:
1324:
1322:
1319:
1317:
1314:
1312:
1309:
1307:
1304:
1302:
1299:
1297:
1294:
1292:
1289:
1287:
1284:
1283:
1281:
1279:
1275:
1269:
1266:
1264:
1261:
1259:
1256:
1254:
1251:
1249:
1246:
1245:
1243:
1239:
1229:
1226:
1225:
1224:
1221:
1219:
1216:
1214:
1211:
1209:
1206:
1204:
1201:
1199:
1196:
1192:
1189:
1187:
1184:
1183:
1182:
1179:
1177:
1174:
1172:
1169:
1167:
1164:
1162:
1159:
1157:
1154:
1152:
1149:
1147:
1144:
1142:
1139:
1137:
1134:
1132:
1129:
1127:
1124:
1123:
1122:
1119:
1115:
1112:
1111:
1110:
1107:
1105:
1102:
1100:
1097:
1095:
1092:
1090:
1087:
1085:
1082:
1078:
1075:
1074:
1073:
1070:
1068:
1065:
1063:
1060:
1058:
1055:
1053:
1050:
1048:
1045:
1043:
1040:
1036:
1033:
1032:
1031:
1028:
1026:
1023:
1021:
1018:
1016:
1013:
1011:
1008:
1006:
1003:
1001:
998:
996:
993:
989:
986:
985:
984:
981:
979:
976:
974:
971:
969:
966:
964:
961:
959:
956:
954:
951:
949:
946:
944:
941:
937:
934:
933:
932:
929:
927:
924:
922:
919:
917:
914:
912:
909:
905:
902:
900:
897:
895:
892:
891:
890:
887:
885:
882:
880:
879:Canonical XML
877:
875:
872:
870:
867:
865:
862:
861:
859:
857:
853:
850:
844:
839:
832:
827:
825:
820:
818:
813:
812:
809:
802:
799:
796:
793:
791:
788:
786:
783:
781:
780:Canonical XML
778:
776:
773:
772:
768:
754:
748:
745:
737:
730:
727:
712:
706:
703:
698:
692:
689:
685:
680:
677:
666:
665:
660:
653:
650:
647:
642:
639:
636:
631:
628:
623:
617:
614:
609:
602:
600:
596:
593:
588:
585:
580:
574:
571:
566:
560:
557:
551:
547:
544:
541:
538:
536:
533:
531:
530:Canonical XML
528:
527:
523:
518:
514:
513:SBR Assurance
508:
503:
499:
496:
492:
488:
484:
481:
477:
476:
475:
469:
467:
464:
462:
457:
455:
446:
444:
442:
439:, but on the
438:
434:
430:
422:
420:
418:
417:XML namespace
414:
408:
402:
398:
393:
390:
385:
375:
367:
365:
359:
353:
330:
327:
316:
313:
312:
311:
310:is followed.
309:
301:
296:
288:
281:
274:
259:
251:
240:
237:contains the
233:
227:
221:
220:
214:
195:
194:
188:
187:
155:<Reference
109:
95:
93:
91:
87:
83:
79:
75:
71:
66:
64:
60:
56:
52:
48:
45:
41:
37:
34:) defines an
33:
29:
25:
22:(also called
21:
20:XML Signature
1155:
846:Products and
756:. Retrieved
747:
729:
718:. Retrieved
705:
691:
679:
668:. Retrieved
662:
652:
641:
630:
616:
587:
573:
559:
473:
470:Applications
465:
458:
450:
426:
412:
409:
400:
394:
386:
382:<Elem>
371:
354:
350:
328:
314:
307:
305:
294:
229:DigestMethod
215:One or more
99:
89:
85:
69:
67:
31:
27:
23:
19:
18:
1681:Conferences
1557:WebAssembly
1526:WebAssembly
1429:WebPlatform
1084:Web storage
1067:WebAssembly
864:ActivityPub
505: [
495:PKIoverheid
491:Netherlands
441:XML Infoset
437:binary data
323:DigestValue
235:DigestValue
171:<KeyInfo
92:signature.
38:syntax for
1718:Categories
1610:CERN httpd
1397:Deprecated
1371:Initiative
1355:Guidelines
1263:XHTML+SMIL
1131:Encryption
1094:Webmention
1057:Timed text
894:Animations
758:2023-09-07
720:2023-09-07
670:2020-07-24
552:References
405:SignedInfo
333:SignedInfo
266:SignedInfo
223:Transforms
210:SignedInfo
191:SignedInfo
177:<Object
90:enveloping
1660:(1994–97)
1652:(1994–97)
1644:(1993–98)
1633:Line Mode
1438:Obsoleted
1248:IndieAuth
1156:Signature
1146:Namespace
943:IndexedDB
921:EmotionML
848:standards
664:JavaWorld
364:methods.
319:Reference
243:Reference
217:Reference
102:Signature
96:Structure
86:enveloped
1625:Browsers
1599:Software
1531:WebAuthn
1228:elements
1198:XPointer
1166:XInclude
1062:VoiceXML
968:Micropub
524:See also
519:program.
487:auditors
423:Benefits
70:resource
28:XML-DSig
1696:(IW3C2)
1690:(IW3C)
1636:(1990–)
1341:XFrames
953:JSON-LD
899:Flexbox
489:in the
374:Infoset
341:KeyInfo
284:KeyInfo
276:KeyInfo
51:PKCS #7
32:XML-Sig
24:XMLDSig
1615:Libwww
1576:(DDWG)
1536:WHATWG
1404:C-HTML
1326:WebGPU
1218:XSL-FO
1208:XQuery
1161:XForms
1151:Schema
1136:Events
1099:WebSub
1052:SPARQL
988:Schema
963:MathML
686:, 2007
447:Issues
291:Object
258:Base64
239:Base64
1665:Amaya
1649:Agora
1641:Arena
1587:(MMI)
1495:Board
1331:WebXR
1301:InkML
1291:CURIE
1286:CCXML
1253:XAdES
1241:Notes
1203:XProc
1181:XPath
1171:XLink
1114:+RDFa
1109:XHTML
1047:SHACL
1042:SCXML
936:HTML5
840:(W3C)
739:(PDF)
714:(PDF)
540:XAdES
509:]
358:XPath
317:Each
280:X.509
180:/>
174:/>
168:/>
160:etc.
158:/>
149:/>
143:/>
137:/>
128:/>
122:/>
1657:Argo
1580:HTML
1419:PGML
1414:JSSS
1409:HDML
1336:XFDL
1321:sXBL
1223:XSLT
1126:Base
1104:WOFF
1089:WSDL
1025:SSML
1015:SRGS
1010:SOAP
1005:SMIL
1000:SKOS
995:SISR
931:HTML
904:Grid
874:ARIA
493:. A
480:XBRL
431:and
401:C14n
331:The
289:The
252:The
200:and
196:The
189:The
74:type
63:SAML
59:SOAP
1521:SVG
1516:CSS
1500:TAG
1445:P3P
1424:VML
1311:RIF
1306:MSE
1296:EME
1268:XUP
1258:XBL
1213:XSL
1191:3.x
1186:2.0
1176:XOP
1121:XML
1072:WoT
1030:SVG
1020:SRI
983:RDF
978:PLS
973:OWL
948:ITS
916:EXI
911:DOM
889:CSS
884:CDF
485:by
454:SOA
78:URL
55:Web
36:XML
1720::
1559:CG
1490:AB
1077:TD
661:.
598:^
507:nl
463:.
384:.
61:,
30:,
26:,
830:e
823:t
816:v
761:.
741:.
723:.
699:.
673:.
624:.
610:.
581:.
567:.
347:.
297:.
272:.
Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.