The

XML Signature and XML Encryption, two of the three major pillars of the WS-Security standard, are so predominant in current thinking about Web Services Security that some people mistake them as the only strategy for securing Web services. This is really not the case at all. Read more in this chapter from Securing Web Services with WS-Security, by Rosenberg and Remy (ISBN 0672326515, SAMS, 2004).

TABLE OF CONTENTS:

Safeguarding the Identity and Integrity of XML Messages XML Signature Fundamentals XML Signature Structure Types of XML Signatures The Signature Element Schema XML Signature Processing XML Signature Validation The XML Signature Elements Canonicalization Actions from Canonical XML Version 1.0 The SignatureMethod Element The Reference Element The Transform Element XPath Filtering Transform Enveloped Signature Transform XPath Filter 2.0 Transform The DigestMethod Element The Object Element The Manifest Element The KeyInfo Element Security Strategies for XML Signature Summary

By: Sams Publishing	Poor Best
Rating:  / 7
September 09, 2004

print this article

The DigestMethod element represents an identifier for the algorithm used to calculate the digest of the Reference URI plus all the Transforms.

---

Note - The digest algorithm itself must receive its information in the form of octets. Typically, if a conversion is needed from an XML nodeset to octets, it is handled automatically. However, in some cases, an additional Transform may be required to ensure that the input to the digest algorithm is in the form of octets or to ensure that the XML nodeset is canonicalized so that it has the highest likelihood of valid comparison on any platform.

---

The only required digest algorithm is SHA1, and it is designated by

Algorithm=http://www.w3.org/2000/09/xmldsig#sha1

The DigestValue Element

The DigestValue element contains the Base-64 encoded value of the digest. The following DigestValue element is taken from the example we gave near the beginning of the chapter:

<DigestValue>60NvZvtdTB+7UnlLp/H24p7h4bs=</DigestValue>

The SignatureValue Element

At this point, the SignatureValue element must seem anti-climactic even though it represents the signature itself. The SignatureValue element is the Base-64 encoded resulting value of encrypting a digest of the SignedInfo element. The particular signature method used is defined within the SignatureMethod element itself (for example, RSA-SHA1). Here is an example of a SignatureValue:

<SignatureValue> hTHQJyd3C6ww/OJz07P4bMOgjqBdznSUOsCh6P+0MpF69w2tln/PFLdx/EP4/VKX </SignatureValue>

So far, we have reviewed the core aspects of the XML Signature, SignedInfo, and SignatureValue elements. If you understand them well, you have a good basis for understanding and using XML Signatures. The next two elements, Object and KeyInfo, are optional, but in many circumstances, necessary and important elements.