XML Signature
XML Signature (also called XMLDSig, XML-DSig, XML-Sig) defines an XML syntax for digital signatures and is defined in the W3C recommendation XML Signature Syntax and Processing. Functionally, it has much in common with PKCS#7 but is more extensible and geared towards signing XML documents. It is used by various Web technologies such as SOAP, SAML, and others.
XML signatures can be used to sign data–a resource–of any type, typically XML documents, but anything that is accessible via a URL can be signed. An XML signature used to sign a resource outside its containing XML document is called a detached signature; if it is used to sign some part of its containing document, it is called an enveloped signature; if it contains the signed data within itself it is called an enveloping signature.
Structure
An XML Signature consists of a Signature element in the http://www.w3.org/2000/09/xmldsig# namespace. The basic structure is as follows:
SignedInfo element contains or references the signed data and specifies what algorithms are used.
- The
SignatureMethodandCanonicalizationMethodelements are used by theSignatureValueelement and are included inSignedInfoto protect them from tampering. - One or more
Referenceelements specify the resource being signed by URI reference; and any transforms to be applied to the resource prior to signing. A transformation can be a XPath-expression that selects a defined subset of the document tree.-
DigestMethodspecifies the hash algorithm before applying the hash. -
DigestValuecontains the Base64 encoded result of applying the hash algorithm to the transformed resource(s) defined in theReferenceelement attributes.
-
Podcasts:
