Question

I need to sign a whole XML document using "XML Signature" standard. A requirement is that the signature must be placed within the signed document.

My approach for doing so is using an enveloped signature. What confuses me is the actual requirement when it comes to the placement of the signature element. When looking at examples it seems as if the most common way of doing it is placing the signature element as a child element of the root element and making it the last of its children like this:

<?xml version="1.0"?>
<myRootElement>
    <someChildElement></someChildElement>

    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        ...
        <ds:Reference URI="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        ...
    </ds:Signature>

</myRootElement>

What I'm wondering is: What are the exact requirements when it comes to the placement? Must it be placed as a child of the root element or is it allowed to make it just a decendent of the root element? Like this:

<?xml version="1.0"?>
<myRootElement>
    <someChildElement>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            ...
            <ds:Reference URI="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            ...
        </ds:Signature>
    </someChildElement>
</myRootElement>

I try to understand this from the specification itself but I fail to do so (maybe because english is not my native language). I would appreciate your input on this! Thanks in advance!

Was it helpful?

Solution

As we read the standard, we find the following definition:

Signature, Enveloped The signature is over the XML content that contains the signature as an element. The content provides the root XML document element. Obviously, enveloped signatures must take care not to include their own value in the calculation of the SignatureValue.

It basically says that the enveloped signature must be a child of the element being signed.

If you sign some deeply buried node with embedded signature, the signature block will go into that node.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top