Digitally Sign Parts of a XML document

问题:

I have an XML document having structure similar to the following

<envelop>
    <header>blaa</header>
    <message>blaa blaa</message>
    <footer></footer>
</envelop>

I want to digitally sign the header and message elements and add the signature to the footer element.

How can I sign the elements and then later verify the signature (using .net c#) ?

回答1:

You should be able to add an XPath-Transform to the Signature. It should look something like this:

       <Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
         <XPath xmlns:dsig="&dsig;">
         ...
         </XPath>
       </Transform>

I am not fluent in XPath, but it should be easy to formulate an XPath-expression that excludes the Footer-element. (But note that XPath is an optional part of XML-DSIG, so not all implementations may support it).

Alternatively, if you could restructure your document to be

<envelop>
  <header>blaa</header>
  <message>blaa blaa</message>
  <Signature></Signature>
</envelop>

or

<envelop>
  <signedEnvelope>
    <header>blaa</header>
    <message>blaa blaa</message>
  </signedEnvelope>
  <Signature></Signature>
</envelop>

you could handle it by using an Enveloped Signature Transform (first case) or by signing the signedEnvelope element (second case).

回答2:

Read This http://msdn.microsoft.com/en-us/library/ms229745.aspx

回答3:

There's a Microsoft partner which could be pretty good for this. They allow you to add digital signatures for XML (as well as all other platforms). I recommend checking their product, it's called cosign.

回答4:

http://social.msdn.microsoft.com/Search/en-US/?query=digital%20signature%20xml&ac=3

回答5:

Why not follow w3 recomendation for XML signing http://www.w3.org/2000/09/xmldsig# it has a basic structure:

<Signature>
   <SignedInfo>
      <SignatureMethod />
      <CanonicalizationMethod />
      <Reference>
         <Transforms>
         <DigestMethod>
         <DigestValue>
      </Reference>
      <Reference /> etc.
   </SignedInfo>
   <SignatureValue />
   <KeyInfo />
   <Object />
</Signature>

If you want more advanced features, read about XAdES - i think it's avalible in c#.

回答6:

I see this post is old, but maybe somebody has the same need now. What you need is somehow like an enveloped signature in XMLDSIG. The difference is that in XMLDSIG you have to include the signature data in a Signature node.

If you want to do this, you have to implement it your own.

I'm involved in a project to develope a library to provide XAdES support for the .NET Framework.

We've just released version 1.0, that provides early support for XAdES-BES.

You can find it in XAdES .NET Project

I hope the source code may help you somehow.

Regards.