XML Security Library: XML Digital Signature

Home Download News Documentation FAQ Tutorial API reference Examples XML Digital Signature Online Verifier XML Encryption XML Canonicalization Reporting Bugs Mailing list Related Authors
## XML Digital Signature XML Digital Signature provides integrity, message authentication, and/or signer authentication services for data of any type, whether located within the XML that includes the signature or elsewhere. XML Security Library supports all MUST/SHOULD/MAY features and algorithms described in the W3C standard and provides API to sign prepared document templates, add signature(s) to a document "on-the-fly" or verify the signature(s) in the document. XML Digital Signature Online Verifier is an example of a real application based on XML Security Library. Using this tool you can verify any XML Signature and get detailed report on what and how was signed. ### XML Security Library XML Signature Interoperability Report
Features and algorithms | Key Word | XMLSec with OpenSSL | XMLSec with GnuTLS | XMLSec with NSS | XMLSec with MSCrypto
Detached Signature | MUST | Y | Y | Y | Y
Enveloping Signature: same document reference with fragment (URI="#Object1") | MUST | Y | Y | Y | Y
Enveloped Signature: same document reference (URI="") with Enveloped Signature Transform . | MUST | Y | Y | Y | Y
SignatureValue generation/validation | MUST | Y | Y | Y | Y
Manifest DigestValue generation/valdiation | MAY | Y | Y | Y | Y
Feature: laxly schema valid Signature element generation | MUST | Y | Y | Y | Y
XPointers '#xpointer(/)' | SHOULD | Y | Y | Y | Y
XPointers '#xpointer(id("ID"))' | SHOULD | Y | Y | Y | Y
XPointers: full suppport | MAY | Y | Y | Y | Y
XPath | SHOULD | Y | Y | Y | Y
the dsig XPath 'here()' function (can be used to implement enveloped signature) | SHOULD | Y | Y | Y | Y
XSLT (note, the child `XSLT` element of Transform has been deprecated.) | MAY | Y | Y | Y | Y
RetrievalMethod (e.g., X509Data) | SHOULD | Y | Y | Y | Y
SHA1 | MUST | Y | Y | Y | Y
Base64 | MUST | Y | Y | Y | Y
HMAC-SHA1 | MUST | Y | Y | Y | N
DSAwithSHA1 (DSS) | MUST | Y(1) | N | Y | Y
RSAwithSHA1 | SHOULD | Y | N | Y | Y
X509 support | SHOULD | Y | N | Y | Y
minimal (deprecated) | n/a | N | N | N | N
Canonical XML (20010315) | MUST | Y | Y | Y | Y
Canonical XML with comments | SHOULD | Y | Y | Y | Y
Exlusive Canonical XML | SHOULD | Y | Y | Y | Y
Exlusive Canonical XML with comments | SHOULD | Y | Y | Y | Y
Enveloped Signature | MUST | Y | Y | Y | Y
Additional algorithms ( * ) |  |  |  |  |
HMAC-MD5 |  | Y | Y | Y | N
HMAC-RIPEMD160 |  | Y | Y | N | N
XPointer transform |  | Y | Y | Y | Y
(1) Defining DSA key with Seed and PgenCounter is not supported. Test vectors (from IETF/W3C XML Signature WG: XML Signature Interoperability page): merlin-xmldsig-twenty-three.tar.gz merlin-xmldsig-sixteen.tar.gz (features, deprecated) merlin-xmldsig-fifteen.tar.gz (algorithms, deprecated)
Aleksey Sanin