The

XML Signature and XML Encryption, two of the three major pillars of the WS-Security standard, are so predominant in current thinking about Web Services Security that some people mistake them as the only strategy for securing Web services. This is really not the case at all. Read more in this chapter from Securing Web Services with WS-Security, by Rosenberg and Remy (ISBN 0672326515, SAMS, 2004).

TABLE OF CONTENTS:

Safeguarding the Identity and Integrity of XML Messages XML Signature Fundamentals XML Signature Structure Types of XML Signatures The Signature Element Schema XML Signature Processing XML Signature Validation The XML Signature Elements Canonicalization Actions from Canonical XML Version 1.0 The SignatureMethod Element The Reference Element The Transform Element XPath Filtering Transform Enveloped Signature Transform XPath Filter 2.0 Transform The DigestMethod Element The Object Element The Manifest Element The KeyInfo Element Security Strategies for XML Signature Summary

By: Sams Publishing	Poor Best
Rating:  / 7
September 09, 2004

print this article

SignatureMethod names the algorithm that will be used for signing and verifying signatures. Two signature algorithms are required: DSAwithSHA1, which is an implementation of the Digital Signature Algorithm (DSA), and HMAC-SHA1. DSAwithSHA1 is a public key strategy (sign with a private key, decrypt with a public key), and HMAC-SHA1 is a shared key hashed message authentication code strategy. This is a little unusual. Digital signatures are typically meant to validate integrity (that the document has not changed) and identity (that a particular individual, device, or process signed the document). Validation of identity is associated with public key cryptography (for example, DSA or RSA), not shared key cryptography. A shared key approach is typically not associated with digital signatures; however, the XML working group wanted to allow for a situation in which the primary purpose for the signature was integrity, and HMAC-SHA1 is an excellent (and fast) way to accomplish this goal.

In addition to the DSA algorithm, RSAwithSHA1 is recommended (but not required). Remember that the DSA algorithm and, consequently, DSA keys can be used only for digital signatures. The RSA public key algorithms can be used for both digital signatures and encryption and are more commonly used than DSA. Most, if not all, XML Signature implementations support RSAwithSHA1.

The following is an example of a SignatureMethod element:

<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" />