XML digital signature
XML-Signature Syntax and Processing (XML digital signature) is a spec that defines XML syntax and processing rules to sign and verify digital signatures for digital content. The spec was developed jointly by the World Wide Web Consortium (W3C) and the IETF.
XML digital signature does not introduce new cryptographic algorithms. WAS uses XML digital signature with existing algorithms such as RSA, HMAC, and SHA1. XML signature defines many methods for describing key information and enables the definition of a new method. XML canonicalization (c14n) is often needed when you use XML signature. Information can be represented in various ways within serialized XML documents. For example, although their octet representations are different, the following examples are identical:
- <person first="John" last="Smith"/>
- <person last="Smith" first="John"></person>
C14n is a process used to canonicalize XML information. Select an appropriate c14n algorithm because the information that is canonicalized is dependent upon this algorithm. One of the major c14n algorithms, Exclusive XML Canonicalization, canonicalizes the character encoding scheme, attribute order, namespace declarations, and so on. The algorithm does not canonicalize white space outside tags, namespace prefixes, or data type representation.
XML signature in the WS-Security-Core spec
The WS-Security-Core (WSS-Core) spec defines a standard way for SOAP messages to incorporate an XML signature. Use almost all of the XML signature features in WSS-Core except enveloped signature and enveloping signature. However, WSS-Core has some recommendations such as exclusive canonicalization for the c14n algorithm and some additional features such as SecurityTokenReference and KeyIdentifier.
The KeyIdentifier is the value of the SubjectKeyIdentifier field within the X.509 certificate.
See on the KeyIdentifier, see "Reference to a Subject Key Identifier" within the OASIS WS-Security X.509 Certificate Token Profile documentation. By including XML signature in SOAP messages, the following issues are realized:
- Message integrity
- A message receiver can confirm that attackers or accidents have not altered parts of the message after these parts are signed by a key.
- Authentication
- We can assume that a valid signature is proof of possession. A message with a digital certificate that is issued by a certificate authority and a signature in the message that is validated successfully by a public key in the certificate, is proof that the signer has the corresponding private key. The receiver can authenticate the signer by checking the trustworthiness of the certificate.
Related concepts
WS-Security provides message integrity, confidentiality, and authentication
Related information
Exclusive XML Canonicalization