This section identifies algorithms used with the XML digital
signature specification. Entries contain the identifier to be used
in Signature elements, a reference to the formal specification, and
definitions, where applicable, for the representation of keys and the
results of cryptographic operations.
6.1 Algorithm Identifiers and Implementation Requirements
Algorithms are identified by URIs that appear as an attribute to the
element that identifies the algorithms' role (DigestMethod,
Transform, SignatureMethod, or CanonicalizationMethod). All
algorithms used herein take parameters but in many cases the
parameters are implicit. For example, a SignatureMethod is
implicitly given two parameters: the keying info and the output of
CanonicalizationMethod. Explicit additional parameters to an
algorithm appear as content elements within the algorithm role
element. Such parameter elements have a descriptive element name,
which is frequently algorithm specific, and MUST be in the XML
Signature namespace or an algorithm specific namespace.
This specification defines a set of algorithms, their URIs, and
requirements for implementation. Requirements are specified over
implementation, not over requirements for signature use.
Furthermore, the mechanism is extensible; alternative algorithms may
be used by signature applications.
1. Required SHA1
1. Required base64
1. Required HMAC-SHA1
1. Required DSAwithSHA1 (DSS)
2. Recommended RSAwithSHA1
1. Required Canonical XML (omits comments)
2. Recommended Canonical XML with Comments
1. Optional XSLT
2. Recommended XPath
3. Required Enveloped Signature*
* The Enveloped Signature transform removes the Signature element
from the calculation of the signature when the signature is within
the content that it is being signed. This MAY be implemented via the
RECOMMENDED XPath specification specified in 6.6.4: Enveloped
Signature Transform; it MUST have the same effect as that specified
by the XPath Transform.
6.2 Message Digests
Only one digest algorithm is defined herein. However, it is expected
that one or more additional strong digest algorithms will be
developed in connection with the US Advanced Encryption Standard
effort. Use of MD5 [MD5] is NOT RECOMMENDED because recent advances
in cryptanalysis have cast doubt on its strength.
The SHA-1 algorithm [SHA-1] takes no explicit parameters. An example
of an SHA-1 DigestAlg element is:
A SHA-1 digest is a 160-bit string. The content of the DigestValue
element shall be the base64 encoding of this bit string viewed as a
20-octet octet stream. For example, the DigestValue element for the
A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D
from Appendix A of the SHA-1 standard would be:
6.3 Message Authentication Codes
MAC algorithms take two implicit parameters, their keying material
determined from KeyInfo and the octet stream output by
CanonicalizationMethod. MACs and signature algorithms are
syntactically identical but a MAC implies a shared secret key.
The HMAC algorithm (RFC2104 [HMAC]) takes the truncation length in
bits as a parameter; if the parameter is not specified then all the
bits of the hash are output. An example of an HMAC SignatureMethod
The output of the HMAC algorithm is ultimately the output (possibly
truncated) of the chosen digest algorithm. This value shall be
base64 encoded in the same straightforward fashion as the output of
the digest algorithms. Example: the SignatureValue element for the
9294727A 3638BB1C 13F48EF8 158BFC9D
from the test vectors in [HMAC] would be
<!ELEMENT HMACOutputLength (#PCDATA)>
6.4 Signature Algorithms
Signature algorithms take two implicit parameters, their keying
material determined from KeyInfo and the octet stream output by
CanonicalizationMethod. Signature and MAC algorithms are
syntactically identical but a signature implies public key
The DSA algorithm [DSS] takes no explicit parameters. An example of
a DSA SignatureMethod element is:
The output of the DSA algorithm consists of a pair of integers
usually referred by the pair (r, s). The signature value consists of
the base64 encoding of the concatenation of two octet-streams that
respectively result from the octet-encoding of the values r and s in
that order. Integer to octet-stream conversion must be done
according to the I2OSP operation defined in the RFC 2437 [PKCS1]
specification with a l parameter equal to 20. For example, the
SignatureValue element for a DSA signature (r, s) with values
specified in hexadecimal:
r = 8BAC1AB6 6410435C B7181F95 B16AB97C 92B341C0
s = 41E2345F 1F56DF24 58F426D1 55B4BA2D B6DCD8C8
from the example in Appendix 5 of the DSS standard would be
6.4.2 PKCS1 (RSA-SHA1)
The expression "RSA algorithm" as used in this document refers to the
RSASSA-PKCS1-v1_5 algorithm described in RFC 2437 [PKCS1]. The RSA
algorithm takes no explicit parameters. An example of an RSA
SignatureMethod element is:
The SignatureValue content for an RSA signature is the base64 [MIME]
encoding of the octet string computed as per RFC 2437 [PKCS1, section
8.1.1: Signature generation for the RSASSA-PKCS1-v1_5 signature
scheme]. As specified in the EMSA-PKCS1-V1_5-ENCODE function RFC
2437 [PKCS1, section 9.2.1], the value input to the signature
function MUST contain a pre-pended algorithm object identifier for
the hash function, but the availability of an ASN.1 parser and
recognition of OIDs are not required of a signature verifier. The
PKCS#1 v1.5 representation appears as:
CRYPT (PAD (ASN.1 (OID, DIGEST (data))))
Note that the padded ASN.1 will be of the following form:
01 | FF* | 00 | prefix | hash
where "|" is concatenation, "01", "FF", and "00" are fixed octets of
the corresponding hexadecimal value, "hash" is the SHA1 digest of the
data, and "prefix" is the ASN.1 BER SHA1 algorithm designator prefix
required in PKCS1 [RFC 2437], that is,
hex 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14
This prefix is included to make it easier to use standard
cryptographic libraries. The FF octet MUST be repeated the maximum
number of times such that the value of the quantity being CRYPTed is
one octet shorter than the RSA modulus.
The resulting base64 [MIME] string is the value of the child text
node of the SignatureValue element, e.g.,
6.5 Canonicalization Algorithms
If canonicalization is performed over octets, the canonicalization
algorithms take two implicit parameters: the content and its charset.
The charset is derived according to the rules of the transport
protocols and media types (e.g., RFC2376 [XML-MT] defines the media
types for XML). This information is necessary to correctly sign and
verify documents and often requires careful server side
Various canonicalization algorithms require conversion to [UTF-8].
The two algorithms below understand at least [UTF-8] and [UTF-16] as
input encodings. We RECOMMEND that externally specified algorithms
do the same. Knowledge of other encodings is OPTIONAL.
Various canonicalization algorithms transcode from a non-Unicode
encoding to Unicode. The two algorithms below perform text
normalization during transcoding [NFC, NFC-Corrigendum]. We
RECOMMEND that externally specified canonicalization algorithms do
the same. (Note, there can be ambiguities in converting existing
charsets to Unicode, for an example see the XML Japanese Profile
6.5.1 Canonical XML
Identifier for REQUIRED Canonical XML (omits comments):
Identifier for Canonical XML with Comments:
An example of an XML canonicalization element is:
The normative specification of Canonical XML is [XML-C14N]. The
algorithm is capable of taking as input either an octet stream or an
XPath node-set (or sufficiently functional alternative). The
algorithm produces an octet stream as output. Canonical XML is
easily parameterized (via an additional URI) to omit or retain
6.6 Transform Algorithms
A Transform algorithm has a single implicit parameter: an octet
stream from the Reference or the output of an earlier Transform.
Application developers are strongly encouraged to support all
transforms listed in this section as RECOMMENDED unless the
application environment has resource constraints that would make such
support impractical. Compliance with this recommendation will
maximize application interoperability and libraries should be
available to enable support of these transforms in applications
without extensive development.
Any canonicalization algorithm that can be used for
CanonicalizationMethod (such as those in Canonicalization Algorithms
(section 6.5)) can be used as a Transform.
The normative specification for base64 decoding transforms is [MIME].
The base64 Transform element has no content. The input is decoded by
the algorithms. This transform is useful if an application needs to
sign the raw data associated with the encoded content of an element.
This transform requires an octet stream for input. If an XPath
node-set (or sufficiently functional alternative) is given as input,
then it is converted to an octet stream by performing operations
logically equivalent to 1) applying an XPath transform with
expression self::text(), then 2) taking the string-value of the
node-set. Thus, if an XML element is identified by a barename
XPointer in the Reference URI, and its content consists solely of
base64 encoded character data, then this transform automatically
strips away the start and end tags of the identified element and any
of its descendant elements as well as any descendant comments and
processing instructions. The output of this transform is an octet
6.6.3 XPath Filtering
The normative specification for XPath expression evaluation is
[XPath]. The XPath expression to be evaluated appears as the
character content of a transform parameter child element named XPath.
The input required by this transform is an XPath node-set. Note that
if the actual input is an XPath node-set resulting from a null URI or
barename XPointer dereference, then comment nodes will have been
omitted. If the actual input is an octet stream, then the
application MUST convert the octet stream to an XPath node-set
suitable for use by Canonical XML with Comments. (A subsequent
application of the REQUIRED Canonical XML algorithm would strip away
these comments.) In other words, the input node-set should be
equivalent to the one that would be created by the following process:
1. Initialize an XPath evaluation context by setting the initial node
equal to the input XML document's root node, and set the context
position and size to 1.
2. Evaluate the XPath expression (//. | //@* | //namespace::*)
The evaluation of this expression includes all of the document's
nodes (including comments) in the node-set representing the octet
The transform output is also an XPath node-set. The XPath expression
appearing in the XPath parameter is evaluated once for each node in
the input node-set. The result is converted to a boolean. If the
boolean is true, then the node is included in the output node-set.
If the boolean is false, then the node is omitted from the output
Note: Even if the input node-set has had comments removed, the
comment nodes still exist in the underlying parse tree and can
separate text nodes. For example, the markup <e>Hello, <!-- comment
-->world!</e> contains two text nodes. Therefore, the expression
self::text()[string()="Hello, world!"] would fail. Should this
problem arise in the application, it can be solved by either
canonicalizing the document before the XPath transform to physically
remove the comments or by matching the node based on the parent
element's string value (e.g., by using the expression
The primary purpose of this transform is to ensure that only
specifically defined changes to the input XML document are permitted
after the signature is affixed. This is done by omitting precisely
those nodes that are allowed to change once the signature is affixed,
and including all other input nodes in the output. It is the
responsibility of the XPath expression author to include all nodes
whose change could affect the interpretation of the transform output
in the application context.
An important scenario would be a document requiring two enveloped
signatures. Each signature must omit itself from its own digest
calculations, but it is also necessary to exclude the second
signature element from the digest calculations of the first signature
so that adding the second signature does not break the first
The XPath transform establishes the following evaluation context for
each node of the input node-set:
* A context node equal to a node of the input node-set.
* A context position, initialized to 1.
* A context size, initialized to 1.
* A library of functions equal to the function set defined in
[XPath] plus a function named here.
* A set of variable bindings. No means for initializing these is
defined. Thus, the set of variable bindings used when
evaluating the XPath expression is empty, and use of a variable
reference in the XPath expression results in an error.
* The set of namespace declarations in scope for the XPath
As a result of the context node setting, the XPath expressions
appearing in this transform will be quite similar to those used in
[XSLT], except that the size and position are always 1 to reflect the
fact that the transform is automatically visiting every node (in
XSLT, one recursively calls the command apply-templates to visit the
nodes of the input tree).
The function here() is defined as follows:
Function: node-set here()
The here function returns a node-set containing the attribute or
processing instruction node or the parent element of the text node
that directly bears the XPath expression. This expression results in
an error if the containing XPath expression does not appear in the
same XML document against which the XPath expression is being
As an example, consider creating an enveloped signature (a Signature
element that is a descendant of an element being signed). Although
the signed content should not be changed after signing, the elements
within the Signature element are changing (e.g., the digest value
must be put inside the DigestValue and the SignatureValue must be
subsequently calculated). One way to prevent these changes from
invalidating the digest value in DigestValue is to add an XPath
Transform that omits all Signature elements and their descendants.
Due to the null Reference URI in this example, the XPath transform
input node-set contains all nodes in the entire parse tree starting
at the root node (except the comment nodes). For each node in this
node-set, the node is included in the output node-set except if the
node or one of its ancestors, has a tag of Signature that is in the
namespace given by the replacement text for the entity &dsig;.
A more elegant solution uses the here function to omit only the
Signature containing the XPath Transform, thus allowing enveloped
signatures to sign other signatures. In the example above, use the
Since the XPath equality operator converts node sets to string values
before comparison, we must instead use the XPath union operator (|).
For each node of the document, the predicate expression is true if
and only if the node-set containing the node and its Signature
element ancestors does not include the enveloped Signature element
containing the XPath expression (the union does not produce a larger
set if the enveloped Signature element is in the node-set given by
6.6.4 Enveloped Signature Transform
An enveloped signature transform T removes the whole Signature
element containing T from the digest calculation of the Reference
element containing T. The entire string of characters used by an XML
processor to match the Signature with the XML production element is
removed. The output of the transform is equivalent to the output
that would result from replacing T with an XPath transform containing
the following XPath parameter element:
The input and output requirements of this transform are identical to
those of the XPath transform, but may only be applied to a node-set
from its parent XML document. Note that it is not necessary to use
an XPath expression evaluator to create this transform. However,
this transform MUST produce output in exactly the same manner as the
XPath transform parameterized by the XPath expression above.
6.6.5 XSLT Transform
The normative specification for XSL Transformations is [XSLT].
Specification of a namespace-qualified stylesheet element, which MUST
be the sole child of the Transform element, indicates that the
specified style sheet should be used. Whether this instantiates in-
line processing of local XSLT declaration within the resource is
determined by the XSLT processing model; the ordered application of
multiple stylesheet may require multiple Transforms. No special
provision is made for the identification of a remote stylesheet at a
given URI because it can be communicated via an xsl:include or
xsl:import within the stylesheet child of the Transform.
This transform requires an octet stream as input. If the actual
input is an XPath node-set, then the signature application should
attempt to convert it to octets (apply Canonical XML]) as described
in the Reference Processing Model (section 18.104.22.168).
The output of this transform is an octet stream. The processing
rules for the XSL style sheet or transform element are stated in the
XSLT specification [XSLT]. We RECOMMEND that XSLT transform authors
use an output method of xml for XML and HTML. As XSLT
implementations do not produce consistent serializations of their
output, we further RECOMMEND inserting a transform after the XSLT
transform to canonicalize the output. These steps will help to
ensure interoperability of the resulting signatures among
applications that support the XSLT transform. Note that if the
output is actually HTML, then the result of these steps is logically
7. XML Canonicalization and Syntax Constraint Considerations
Digital signatures only work if the verification calculations are
performed on exactly the same bits as the signing calculations. If
the surface representation of the signed data can change between
signing and verification, then some way to standardize the changeable
aspect must be used before signing and verification. For example,
even for simple ASCII text there are at least three widely used line
ending sequences. If it is possible for signed text to be modified
from one line ending convention to another between the time of
signing and signature verification, then the line endings need to be
canonicalized to a standard form before signing and verification or
the signatures will break.
XML is subject to surface representation changes and to processing
which discards some surface information. For this reason, XML
digital signatures have a provision for indicating canonicalization
methods in the signature so that a verifier can use the same
canonicalization as the signer.
Throughout this specification we distinguish between the
canonicalization of a Signature element and other signed XML data
objects. It is possible for an isolated XML document to be treated
as if it were binary data so that no changes can occur. In that
case, the digest of the document will not change and it need not be
canonicalized if it is signed and verified as such. However, XML
that is read and processed using standard XML parsing and processing
techniques is frequently changed such that some of its surface
representation information is lost or modified. In particular, this
will occur in many cases for the Signature and enclosed SignedInfo
elements since they, and possibly an encompassing XML document, will
be processed as XML.
Similarly, these considerations apply to Manifest, Object, and
SignatureProperties elements if those elements have been digested,
their DigestValue is to be checked, and they are being processed as
The kinds of changes in XML that may need to be canonicalized can be
divided into four categories. There are those related to the basic
[XML], as described in 7.1 below. There are those related to [DOM],
[SAX], or similar processing as described in 7.2 below. Third, there
is the possibility of coded character set conversion, such as between
UTF-8 and UTF-16, both of which all [XML] compliant processors are
required to support, which is described in the paragraph immediately
below. And, fourth, there are changes that related to namespace
declaration and XML namespace attribute context as described in 7.3
Any canonicalization algorithm should yield output in a specific
fixed coded character set. All canonicalization algorithms
identified in this document use UTF-8 (without a byte order mark
(BOM)) and do not provide character normalization. We RECOMMEND that
signature applications create XML content (Signature elements and
their descendents/content) in Normalization Form C [NFC, NFC-Corrigendum] and check that any XML being consumed is in that form as
well; (if not, signatures may consequently fail to validate).
Additionally, none of these algorithms provide data type
normalization. Applications that normalize data types in varying
formats (e.g., (true, false) or (1,0)) may not be able to validate
each other's signatures.
7.1 XML 1.0, Syntax Constraints, and Canonicalization
XML 1.0 [XML] defines an interface where a conformant application
reading XML is given certain information from that XML and not other
information. In particular,
1. line endings are normalized to the single character #xA by
dropping #xD characters if they are immediately followed by a #xA
and replacing them with #xA in all other cases,
2. missing attributes declared to have default values are provided to
the application as if present with the default value,
3. character references are replaced with the corresponding
4. entity references are replaced with the corresponding declared
5. attribute values are normalized by
5.1 replacing character and entity references as above,
5.2 replacing occurrences of #x9, #xA, and #xD with #x20 (space)
except that the sequence #xD#xA is replaced by a single space,
5.3 if the attribute is not declared to be CDATA, stripping all
leading and trailing spaces and replacing all interior runs of
spaces with a single space.
Note that items (2), (4), and (5.3) depend on the presence of a
schema, DTD or similar declarations. The Signature element type is
laxly schema valid [XML-schema], consequently external XML or even
XML within the same document as the signature may be (only) well-
formed or from another namespace (where permitted by the signature
schema); the noted items may not be present. Thus, a signature with
such content will only be verifiable by other signature applications
if the following syntax constraints are observed when generating any
signed material including the SignedInfo element:
1. attributes having default values be explicitly present,
2. all entity references (except "amp", "lt", "gt", "apos", "quot",
and other character entities not representable in the encoding
chosen) be expanded,
3. attribute value white space be normalized
7.2 DOM/SAX Processing and Canonicalization
In addition to the canonicalization and syntax constraints discussed
above, many XML applications use the Document Object Model [DOM] or
the Simple API for XML [SAX]. DOM maps XML into a tree structure of
nodes and typically assumes it will be used on an entire document
with subsequent processing being done on this tree. SAX converts XML
into a series of events such as a start tag, content, etc. In either
case, many surface characteristics such as the ordering of attributes
and insignificant white space within start/end tags is lost. In
addition, namespace declarations are mapped over the nodes to which
they apply, losing the namespace prefixes in the source text and, in
most cases, losing where namespace declarations appeared in the
If an XML Signature is to be produced or verified on a system using
DOM or SAX processing, a canonical method is needed to serialize the
relevant part of a DOM tree or sequence of SAX events. XML
canonicalization specifications, such as [XML-C14N], are based only
on information which is preserved by DOM and SAX. For an XML
Signature to be verifiable by an implementation using DOM or SAX, not
only must the XML 1.0 syntax constraints given in the previous
section be followed, but an appropriate XML canonicalization MUST be
specified so that the verifier can re-serialize DOM/SAX mediated
input into the same octet stream that was signed.
7.3 Namespace Context and Portable Signatures
In [XPath] and consequently the Canonical XML data model an element
has namespace nodes that correspond to those declarations within the
element and its ancestors:
"Note: An element E has namespace nodes that represent its
namespace declarations as well as any namespace declarations made
by its ancestors that have not been overridden in E's
declarations, the default namespace if it is non-empty, and the
declaration of the prefix xml." [XML-C14N]
When serializing a Signature element or signed XML data that's the
child of other elements using these data models, that Signature
element and its children, may contain namespace declarations from its
ancestor context. In addition, the Canonical XML and Canonical XML
with Comments algorithms import all xml namespace attributes (such as
xml:lang) from the nearest ancestor in which they are declared to the
apex node of canonicalized XML unless they are already declared at
that node. This may frustrate the intent of the signer to create a
signature in one context which remains valid in another. For
example, given a signature which is a child of B and a grandchild of
<Signature xmlns="&dsig;"> ...
<Reference URI="#signme"/> ...
<C ID="signme" xmlns="&baz;"/>
when either the element B or the signed element C is moved into a
[SOAP] envelope for transport:
<C ID="signme" xmlns="&baz;"/>
The canonical form of the signature in this context will contain new
namespace declarations from the SOAP:Envelope context, invalidating
the signature. Also, the canonical form will lack namespace
declarations it may have originally had from element A's context,
also invalidating the signature. To avoid these problems, the
1. Rely upon the enveloping application to properly divorce its body
(the signature payload) from the context (the envelope) before the
signature is validated. Or,
2. Use a canonicalization method that "repels/excludes" instead of
"attracts" ancestor context. [XML-C14N] purposefully attracts
8.0 Security Considerations
The XML Signature specification provides a very flexible digital
signature mechanism. Implementors must give consideration to their
application threat models and to the following factors.
A requirement of this specification is to permit signatures to "apply
to a part or totality of a XML document." (See [XML-Signature-RD,
section 3.1.3].) The Transforms mechanism meets this requirement by
permitting one to sign data derived from processing the content of
the identified resource. For instance, applications that wish to
sign a form, but permit users to enter a limited field data without
invalidating a previous signature on the form might use [XPath] to
exclude those portions the user needs to change. Transforms may be
arbitrarily specified and may include encoding transforms,
canonicalization instructions or even XSLT transformations. Three
cautions are raised with respect to this feature in the following
Note, core validation behavior does not confirm that the signed data
was obtained by applying each step of the indicated transforms.
(Though it does check that the digest of the resulting content
matches that specified in the signature.) For example, some
applications may be satisfied with verifying an XML signature over a
cached copy of already transformed data. Other applications might
require that content be freshly dereferenced and transformed.
8.1.1 Only What is Signed is Secure
First, obviously, signatures over a transformed document do not
secure any information discarded by transforms: only what is signed
Note that the use of Canonical XML [XML-C14N] ensures that all
internal entities and XML namespaces are expanded within the content
being signed. All entities are replaced with their definitions and
the canonical form explicitly represents the namespace that an
element would otherwise inherit. Applications that do not
canonicalize XML content (especially the SignedInfo element) SHOULD
NOT use internal entities and SHOULD represent the namespace
explicitly within the content being signed since they cannot rely
upon canonicalization to do this for them. Also, users concerned
with the integrity of the element type definitions associated with
the XML instance being signed may wish to sign those definitions as
well (i.e., the schema, DTD, or natural language description
associated with the namespace/identifier).
Second, an envelope containing signed information is not secured by
the signature. For instance, when an encrypted envelope contains a
signature, the signature does not protect the authenticity or
integrity of unsigned envelope headers nor its ciphertext form, it
only secures the plaintext actually signed.
8.1.2 Only What is 'Seen' Should be Signed
Additionally, the signature secures any information introduced by the
transform: only what is "seen" (that which is represented to the user
via visual, auditory or other media) should be signed. If signing is
intended to convey the judgment or consent of a user (an automated
mechanism or person), then it is normally necessary to secure as
exactly as practical the information that was presented to that user.
Note that this can be accomplished by literally signing what was
presented, such as the screen images shown a user. However, this may
result in data which is difficult for subsequent software to
manipulate. Instead, one can sign the data along with whatever
filters, style sheets, client profile or other information that
affects its presentation.
8.1.3 'See' What is Signed
Just as a user should only sign what he or she "sees," persons and
automated mechanism that trust the validity of a transformed document
on the basis of a valid signature should operate over the data that
was transformed (including canonicalization) and signed, not the
original pre-transformed data. This recommendation applies to
transforms specified within the signature as well as those included
as part of the document itself. For instance, if an XML document
includes an embedded style sheet [XSLT] it is the transformed
document that should be represented to the user and signed. To meet
this recommendation where a document references an external style
sheet, the content of that external resource should also be signed
via a signature Reference, otherwise the content of that external
content might change which alters the resulting document without
invalidating the signature.
Some applications might operate over the original or intermediary
data but should be extremely careful about potential weaknesses
introduced between the original and transformed data. This is a
trust decision about the character and meaning of the transforms that
an application needs to make with caution. Consider a
canonicalization algorithm that normalizes character case (lower to
upper) or character composition ('e and accent' to 'accented-e'). An
adversary could introduce changes that are normalized and
consequently inconsequential to signature validity but material to a
DOM processor. For instance, by changing the case of a character one
might influence the result of an XPath selection. A serious risk is
introduced if that change is normalized for signature validation but
the processor operates over the original data and returns a different
result than intended.
As a result:
* All documents operated upon and generated by signature
applications MUST be in [NFC, NFC-Corrigendum] (otherwise
intermediate processors might unintentionally break the
* Encoding normalizations SHOULD NOT be done as part of a
signature transform, or (to state it another way) if
normalization does occur, the application SHOULD always "see"
(operate over) the normalized form.
8.2 Check the Security Model
This specification uses public key signatures and keyed hash
authentication codes. These have substantially different security
models. Furthermore, it permits user specified algorithms which may
have other models.
With public key signatures, any number of parties can hold the public
key and verify signatures while only the parties with the private key
can create signatures. The number of holders of the private key
should be minimized and preferably be one. Confidence by verifiers
in the public key they are using and its binding to the entity or
capabilities represented by the corresponding private key is an
important issue, usually addressed by certificate or online authority
Keyed hash authentication codes, based on secret keys, are typically
much more efficient in terms of the computational effort required but
have the characteristic that all verifiers need to have possession of
the same key as the signer. Thus any verifier can forge signatures.
This specification permits user provided signature algorithms and
keying information designators. Such user provided algorithms may
have different security models. For example, methods involving
biometrics usually depend on a physical characteristic of the
authorized user that can not be changed the way public or secret keys
can be and may have other security model differences.
8.3 Algorithms, Key Lengths, Certificates, Etc.
The strength of a particular signature depends on all links in the
security chain. This includes the signature and digest algorithms
used, the strength of the key generation [RANDOM] and the size of the
key, the security of key and certificate authentication and
distribution mechanisms, certificate chain validation policy,
protection of cryptographic processing from hostile observation and
Care must be exercised by applications in executing the various
algorithms that may be specified in an XML signature and in the
processing of any "executable content" that might be provided to such
algorithms as parameters, such as XSLT transforms. The algorithms
specified in this document will usually be implemented via a trusted
library, but even there perverse parameters might cause unacceptable
processing or memory demand. Even more care may be warranted with
application defined algorithms.
The security of an overall system will also depend on the security
and integrity of its operating procedures, its personnel, and on the
administrative enforcement of those procedures. All the factors
listed in this section are important to the overall security of a
system; however, most are beyond the scope of this specification.
9. Schema, DTD, Data Model, and Valid Examples
XML Signature Schema Instance
Valid XML schema instance based on the 20001024 Schema/DTD
XML Signature DTD
RDF Data Model
XML Signature Object Example
A cryptographical fabricated XML example that includes foreign
content and validates under the schema, it also uses schemaLocation
to aid automated schema fetching and validation.
RSA XML Signature Example
An XML Signature example with generated cryptographic values by
Merlin Hughes and validated by Gregor Karlinger.
DSA XML Signature Example
Similar to above but uses DSA.
Authentication Code (Protected Checksum)
A value generated from the application of a shared key to a
message via a cryptographic algorithm such that it has the
properties of message authentication (and integrity) but not
signer authentication. Equivalent to protected checksum, "A
checksum that is computed for a data object by means that protect
against active attacks that would attempt to change the checksum
to make it match changes made to the data object." [SEC]
The property, given an authentication code/protected checksum,
that tampering with both the data and checksum, so as to introduce
changes while seemingly preserving integrity, are still detected.
"A signature should identify what is signed, making it
impracticable to falsify or alter either the signed matter or the
signature without detection." [Digital Signature Guidelines, ABA].
The property of the identity of the signer is as claimed. "A
signature should indicate who signed a document, message or
record, and should be difficult for another person to produce
without authorization." [Digital Signature Guidelines, ABA] Note,
signer authentication is an application decision (e.g., does the
signing key actually correspond to a specific identity) that is
supported by, but out of the scope of, this specification.
"A value that (a) is computed by a function that is dependent on
the contents of a data object and (b) is stored or transmitted
together with the object, for the purpose of detecting changes in
the data." [SEC]
The syntax and processing defined by this specification, including
core validation. We use this term to distinguish other markup,
processing, and applications semantics from our own.
Data Object (Content/Document)
The actual binary/octet data being operated on (transformed,
digested, or signed) by an application -- frequently an HTTP
entity [HTTP]. Note that the proper noun Object designates a
specific XML element. Occasionally we refer to a data object as a
document or as a resource's content. The term element content is
used to describe the data between XML start and end tags [XML].
The term XML document is used to describe data objects which
conform to the XML specification [XML].
"The property that data has not been changed, destroyed, or lost
in an unauthorized or accidental manner." [SEC] A simple checksum
can provide integrity from incidental changes in the data; message
authentication is similar but also protects against an active
attack to alter the data whereby a change in the checksum is
introduced so as to match the change in the data.
An XML Signature element wherein arbitrary (non-core) data may be
placed. An Object element is merely one type of digital data (or
document) that can be signed via a Reference.
"A resource can be anything that has identity. Familiar examples
include an electronic document, an image, a service (e.g.,
'today's weather report for Los Angeles'), and a collection of
other resources.... The resource is the conceptual mapping to an
entity or set of entities, not necessarily the entity which
corresponds to that mapping at any particular instance in time.
Thus, a resource can remain constant even when its content---the
entities to which it currently corresponds---changes over time,
provided that the conceptual mapping is not changed in the
process." [URI] In order to avoid a collision of the term entity
within the URI and XML specifications, we use the term data
object, content or document to refer to the actual bits/octets
being operated upon.
Formally speaking, a value generated from the application of a
private key to a message via a cryptographic algorithm such that
it has the properties of integrity, message authentication and/or
signer authentication. (However, we sometimes use the term
signature generically such that it encompasses Authentication Code
values as well, but we are careful to make the distinction when
the property of signer authentication is relevant to the
exposition.) A signature may be (non-exclusively) described as
detached, enveloping, or enveloped.
An application that implements the MANDATORY (REQUIRED/MUST)
portions of this specification; these conformance requirements are
over application behavior, the structure of the Signature element
type and its children (including SignatureValue) and the specified
The signature is over content external to the Signature element,
and can be identified via a URI or transform. Consequently, the
signature is "detached" from the content it signs. This
definition typically applies to separate data objects, but it also
includes the instance where the Signature and data object reside
within the same XML document but are sibling elements.
The signature is over content found within an Object element of
the signature itself. The Object (or its content) is identified
via a Reference (via a URI fragment identifier or transform).
The signature is over the XML content that contains the signature
as an element. The content provides the root XML document
element. Obviously, enveloped signatures must take care not to
include their own value in the calculation of the SignatureValue.
The processing of a data from its source to its derived form.
Typical transforms include XML Canonicalization, XPath, and XSLT.
The core processing requirements of this specification requiring
signature validation and SignedInfo reference validation.
The hash value of the identified and transformed content,
specified by Reference, matches its specified DigestValue.
The SignatureValue matches the result of processing SignedInfo
with CanonicalizationMethod and SignatureMethod as specified in
Core Validation (section 3.2).
The application determines that the semantics associated with a
signature are valid. For example, an application may validate the
time stamps or the integrity of the signer key -- though this
behavior is external to this core specification.
Appendix: Changes from RFC 3075
Numerous minor editorial changes were made. In addition, the
following substantive changes have occurred based on interoperation
experience or other considerations:
1. Minor but incompatible changes in the representation of DSA keys.
In particular, the optionality of several fields was changed and
two fields were re-ordered.
2. Minor change in the X509Data KeyInfo structure to allow multiple
CRLs to be grouped with certificates and other X509 information.
Previously CRLs had to occur singly and each in a separate
3. Incompatible change in the type of PGPKeyID, which had previously
been string, to the more correct base64Binary since it is actually
a binary quantity.
4. Several warnings have been added. Of particular note, because it
reflects a problem actually encountered in use and is the only
warning added that has its own little section, is the warning of
canonicalization problems when the namespace context of signed
[ABA] Digital Signature Guidelines.
http://www.abanet.org/scitech/ec/isc/dsgfree.html[DOM] Document Object Model (DOM) Level 1 Specification.
W3C Recommendation. V. Apparao, S. Byrne, M.
Champion, S. Isaacs, I. Jacobs, A. Le Hors, G.
Nicol, J. Robie, R. Sutor, C. Wilson, L. Wood.
19981001/[DSS] FIPS PUB 186-2 . Digital Signature Standard (DSS).
U.S. Department of Commerce/National Institute of
Standards and Technology.
2/fips186-2.pdf[HMAC] Krawczyk, H., Bellare, M. and R. Canetti, "HMAC:
Keyed-Hashing for Message Authentication", RFC
2104, February 1997.
Donald E. Eastlake 3rd
Motorola, 20 Forbes Boulevard
Mansfield, MA 02048 USA
Joseph M. Reagle Jr., W3C
Massachusetts Institute of Technology
Laboratory for Computer Science
NE43-350, 545 Technology Square
Cambridge, MA 02139
909 Third Ave, 16th Floor
NY, NY 10043 USA
Full Copyright Statement
Copyright (c) 2002 The Internet Society & W3C (MIT, INRIA, Keio), All
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Funding for the RFC Editor function is currently provided by the