Sign Xml

[Henrik Skak Pedersen]

Hi,

I would like send an user a license certificate which is in xml file. It is
ok that they can read it they are just not allowed to change it. I have
tried to sign my xml document using the SignedXml class and the
RSACryptoServiceProvider to create the key and that works fine.

But I guess that the user just can remove the signed part, change the
doucment and resign it. How can I check for that?

The client is a consumer product which is beeing distributed to multiple
locations.

Thanks

Henrik.

[Kevin Yu [MSFT]]

Hi Henrik,

The RSA algorith uses a key pair for encryption and signing. The SignedXml
is destributing the public key. The enduser is using the public key to
check for the signature. The signing here is to ensure the integrality of
the whole xml doc. If you need to let the end user know that the xml is
really signed by you, you have to use a key server for public key exchange.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."