CODEWITHSUNDEEP
xmlcryptographydigital-signaturexml-signaturesignedxml
Eros
Eros

Reputation: 703

Digitally Sign Parts of a XML document

I have an XML document having structure similar to the following 

<envelop>
    <header>blaa</header>
    <message>blaa blaa</message>
    <footer></footer>
</envelop>

I want to digitally sign the header and message elements and add the signature to the footer element.

How can I sign the elements and then later verify the signature (using .net c#) ?

Upvotes: 2

Views: 4190

Answers (6)

KirstenPowell
KirstenPowell

Reputation: 63

There's a Microsoft partner which could be pretty good for this. They allow you to add digital signatures for XML (as well as all other platforms). I recommend checking their product, it's called cosign.

Upvotes: 2

Luis M. Villa
Luis M. Villa

Reputation: 159

I see this post is old, but maybe somebody has the same need now. What you need is somehow like an enveloped signature in XMLDSIG. The difference is that in XMLDSIG you have to include the signature data in a Signature node.

If you want to do this, you have to implement it your own.

I'm involved in a project to develope a library to provide XAdES support for the .NET Framework.

We've just released version 1.0, that provides early support for XAdES-BES.

You can find it in XAdES .NET Project

I hope the source code may help you somehow.

Regards.

Upvotes: 0

Vexatus
Vexatus

Reputation: 890

Why not follow w3 recomendation for XML signing http://www.w3.org/2000/09/xmldsig# it has a basic structure:

<Signature>
   <SignedInfo>
      <SignatureMethod />
      <CanonicalizationMethod />
      <Reference>
         <Transforms>
         <DigestMethod>
         <DigestValue>
      </Reference>
      <Reference /> etc.
   </SignedInfo>
   <SignatureValue />
   <KeyInfo />
   <Object />
</Signature>

If you want more advanced features, read about XAdES - i think it's avalible in c#.

Upvotes: 1

Rasmus Faber
Rasmus Faber

Reputation: 49619

You should be able to add an XPath-Transform to the Signature. It should look something like this:

       <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
         <XPath xmlns:dsig="&dsig;">
         ...
         </XPath>
       </Transform>

I am not fluent in XPath, but it should be easy to formulate an XPath-expression that excludes the Footer-element. (But note that XPath is an optional part of XML-DSIG, so not all implementations may support it).

Alternatively, if you could restructure your document to be

<envelop>
  <header>blaa</header>
  <message>blaa blaa</message>
  <Signature></Signature>
</envelop>

or

<envelop>
  <signedEnvelope>
    <header>blaa</header>
    <message>blaa blaa</message>
  </signedEnvelope>
  <Signature></Signature>
</envelop>

you could handle it by using an Enveloped Signature Transform (first case) or by signing the signedEnvelope element (second case).

Upvotes: 3

John Saunders
John Saunders

Reputation: 161773

http://social.msdn.microsoft.com/Search/en-US/?query=digital%20signature%20xml&ac=3

Upvotes: 1

joe
joe

Reputation: 35077

Read This http://msdn.microsoft.com/en-us/library/ms229745.aspx

Upvotes: 2

Related Questions