XML DSIG Question

[Markus Strobl]

Hi!

I have a general question concerning xml digital signatures.

Is XML-DSIG verifying that the content of the XML document isn't modified or
does XML-DSIG really signs the binary representation of some data (mostly
xml i guess).

To make my question more clearly i have an example:

Are the following 2 XML-Documents the same when signed? Do they result in
the same Signature?

XML 1:

<data><user>som euser</user></data>

XML 2 (indented):

<data>
<user>someuse r</user>
</data>

The content is the same on a DOM-view but its different if you compare it
byte by byte.

So we have a specific problem when i get a signed XML from an external
module and transmit this xml document via soap to a webservice.

The soap serializer builds a dom and serializes it, but it looses is indent
when serialized although the content stays the same.

When the webservice now tries to verify the signature if fails. It can only
verify exactly the same XML-Document i get from the external module (byte by
byte).

So we have to decide if the verification routine is wrong of if its wrong to
build a DOM from a signed document for transmition to the service.

Thanks a lot for any help on this topic!!

Best wishes

Markus

[Kevin Yu [MSFT]]

Hi Markus,

The Xml signature is based on the content of the Xml. In the XML
Canonicalizatio n spec (c14n), it defines a standard form for an XML
document that is guaranteed to provide proper bit-wise comparisons and thus
consistent digital signatures. You can check the following links for more
information on this.

http://xml.coverpages.org/xmlSig.html

http://www.w3.org/TR/1999/WD-xmldsig-core-19991119/

In this case, I think there is something changed when passing the xml to
the web service.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Markus Strobl]

Hi Kevin!!

Thanks a lot for your post, it really made things much clearer to me!

Best wishes

Markus

"Kevin Yu [MSFT]" <v-****@online.mic rosoft.com> schrieb im Newsbeitrag
news:fG******** *****@TK2MSFTNG XA01.phx.gbl...

Hi Markus,

The Xml signature is based on the content of the Xml. In the XML
Canonicalizatio n spec (c14n), it defines a standard form for an XML
document that is guaranteed to provide proper bit-wise comparisons and
thus
consistent digital signatures. You can check the following links for more
information on this.

http://xml.coverpages.org/xmlSig.html

http://www.w3.org/TR/1999/WD-xmldsig-core-19991119/

In this case, I think there is something changed when passing the xml to
the web service.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Kevin Yu [MSFT]]

You're welcome, Markus.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."