<div dir="ltr">Hi<div><br></div><div>I am familiarizing myself with XML signatures using XMLSEC and I have found a few of the standards' definitions slightly confusing.</div><div>So I joined here to ask and also to figure out some of the details of how the library works too.</div><div><br></div><div>With regards to "enveloped-signature Transform", how exactly are we supposed to check the signature?</div><div><br></div><div>I found an example on the internet.</div><div>Can you please see if my explanations of the overall process are correct here?</div><div><br></div><div>The enveloped XML that we are checking is:</div><div><br></div><div><font face="monospace, monospace"><Envelope xmlns="urn:envelope"><br></font></div><div><div><font face="monospace, monospace"> <Signature xmlns="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/<wbr>09/xmldsig#</a>"></font></div><div><font face="monospace, monospace"> <SignedInfo></font></div><div><font face="monospace, monospace"> <CanonicalizationMethod </font><font face="monospace, monospace">Algori<wbr>thm="<a href="http://www.w3.org/TR/2001/REC-xml-c14n-" target="_blank">http://www.w3.org/TR/<wbr>2001/REC-xml-c14n-</a></font><span style="font-family:monospace,monospace">20010315#<wbr>WithComments"/></span></div><div><font face="monospace, monospace"> <SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/" target="_blank">http://www.w3.org/<wbr>2000/09/</a></font><span style="font-family:monospace,monospace">xmldsig#dsa-sha1"/></span></div><div><font face="monospace, monospace"> <Reference URI=""></font></div><div><font face="monospace, monospace"> <Transforms></font></div><div><font face="monospace, monospace"> <Transform Algorithm="<a href="http://www.w3.org/2000/09/" target="_blank">http://www.w3.org/<wbr>2000/09/</a></font><span style="font-family:monospace,monospace">xmldsig#enveloped-<wbr>signature"/></span></div><div><font face="monospace, monospace"> </Transforms></font></div><div><font face="monospace, monospace"> <DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/" target="_blank">http://www.w3.org/<wbr>2000/09/</a></font><span style="font-family:monospace,monospace">xmldsig#sha1"/></span></div><div><font face="monospace, monospace"> <DigestValue><wbr>uooqbWYa5VCqcJCbuymBKqm17vY=</<wbr>DigestValue></font></div><div><font face="monospace, monospace"> </Reference></font></div><div><font face="monospace, monospace"> </SignedInfo></font></div><div><font face="monospace, monospace"> <SignatureValue></font><font face="monospace, monospace">KedJuTob5gtvYx<wbr>9qM3k3gm7kbLBwVbEQRl26S2tmXjqN<wbr>ND7MRGtoew==</font><span style="font-family:monospace,monospace"></SignatureValue></span></div><div><font face="monospace, monospace"> </Signature></font></div><div><font face="monospace, monospace"></Envelope></font></div></div><div><div><div class="gmail-m_6094587630291881423gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><br></div><div dir="ltr"><br></div><div>And my understanding of the overall validation process is:</div><div><br></div><div>1- First we remove all lines from <Signature> to </Signature></div><div><br></div><div>2- We calculate the hash digest of what is left after applying all CanonicalizationMethod transformations and using the DigestMethod in SignedInfo:</div><div><div><Envelope xmlns="urn:envelope"></div><div></Envelope><br></div></div><div><br></div><div>3- If the base64 encoding of this digest matches the specified DigestValue then we continue and take everything from <SignedInfo> to </SignedInfo> and apply the CanonicalizationMethod transformations to it.</div><div><br></div><div>4- We will calculate the digest of this transformed SignedInfo using the SignatureMethod hash algorithm</div><div><br></div><div>5- Finally we take SignatureValue and decode it using a provided public key or a provided public certificate to see if the result matches the calculated result of step (4)</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div>Is this correct in this example?</div><div><br></div><div><br></div><div><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Ramin Zaghi</div><div dir="ltr"><br><div><b>Mosaic3DX™ | <font size="1">User Interface Technology</font></b></div><div><div style="font-size:small"><a href="http://linkedin.com/in/raminzaghi" target="_blank">http://linkedin.com/in/<wbr>raminzaghi</a><br></div></div><div><font size="2"><br><br><br></font></div></div></div></div></div></div></div></div></div>
<div dir="ltr"><br></div></div></div>