Let’s look at the elements that make up the Signed Content portion of the message. Line 5, <CanonicalizationMethod Algorithm=”http://www.w3.org/2001/10/xml-exc-c14n#”/>, identifies
the canonicalization algorithm that is used to create a canonicalized form of the information being
signed — in this case, the digest. This step is needed because of the nature of XML documents
and the programming tools that work with them. XML documents, in some cases, can have slight
textual differences, yet be essentially the same logical document. Small variations in the way
comments are represented or in the way an XML parser handles line delimiters when serializing/
deserializing an XML data structure can create slightly different binary representations of the
same content. If the algorithm that verifies the digital signature were to be run against a slightly
different serialized version of the data, the result could be a fail when indeed it should be a pass.
To avoid this problem, the document is first transformed into its canonicalized form through the
use of a canonicalization algorithm. This algorithm, an implementation of the W3C Exclusive XML
Canonicalization Version 1.0 Specification (see Resources), a W3C recommendation, transforms
the document into its basic canonicalized form. This allows us to get a consistent binary
representation that can be correctly compared and thus yield the correct result.
Line 6, <SignatureMethod Algorithm=”http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>,
indicates the Signature Method Algorithm. This is the algorithm that is used to convert the
output of the canonicalization algorithm into the Signature Value. Our signature algorithm is a
combination of a key dependent algorithm (RSA) and a hash algorithm (SHA1). This algorithm is
an implementation of the RSASSA-PKCS1-v1_5 specification described in W3C RFC 2437 (see
Line 7, <Reference URI=”#sign_content_1043176028580">, indicates the reference element. The
optional URI attribute of Reference identifies the data object that was signed. The Reference
block includes the algorithm that is used to compute the digest, the digest value that was
computed, and the final transform that is performed prior to computing the digest value. Lines 8-
10, <Transforms> <Transform Algorithm=”http://www.w3.org/2001/10/xml-exc-c14n#”/> </
Transforms>, indicate the transformation algorithm, while lines 11 and 12 specify the digest
algorithm and the computed digest value, <DigestMethod Algorithm=”http://www.w3.org/2000/
In our application, the Transform algorithm is once again the W3C Exclusive XML Canonicalization
algorithm discussed above. The method used to compute the digest, the Secure Hash Algorithm,
is part of the U.S. Department of Commerce/National Institute of Standards and Technology’s
Secure Hash standard.
Lines 15-16, <SignatureValue>kGlrrXjKku/WXKxID+JJkEXY+aGNYHc5dy8GwbLFtB5Msll2/
7A8ggkMkjgAqnLg6PTzM7MdKoIAhe+xRHdOysamGucFJQRMrU+JQ4WATJt0bpdClwJy6mexT Su48mq1q5rM9YZh61P7UEUKt+EQ=</SignatureValue>, contain the signature value, which is
actually the encrypted digest value. This value is the output of the Signature Method Algorithm
indicated on line 6 Keys.
Lines 20-48 introduce the concept of keys. A key is used to mathematically transform a normal,
readable text message into an unreadable one for transmission across the internet. Our Web
service will use a public/private-key (a pair of mathematically related keys) or an asymmetric key
encryption scheme. One of these keys is kept secret; this is the private key. In our application,
the Web service requester will sign the digest with his private key prior to sending the document to the service provider.