XML signing : Java Glossary

* 0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (all)

XML signing

You would think XML (extensible Markup Language) would be a nightmare for digital signing, with its variable amounts of whitespace and variable newline characters and lax attitude toward the encoding, but there are a number of ways of digitally signing XML files to that the receiver can be sure the file/message came from who claims to send it and that it was not tampered with. Obviously the sender and receiver must agree on which scheme to use. Some of the schemes I know about are:

HMAC (Hashed Message Authentication Code): used by Amazon.com. Requires a shared secret key.
Oasis: used by Amazon.com. Public/private key. Requires an X.509 certificate. Ridiculous overhead. Requires you to include a huge amount of constant information in the message.
W3C (World Wide Web Consortium): used by PAD (Portable Application Description) files. Public/private key. Requires an X.509 certificate. You specify #xxxx HTML-like targets) and embed the signature in the document. You can also sign documents external to the XML file. The secret is canonicalisation. You use an algorithm to tidy the document to standard form. The transforms leave embedded, lead and trailing whitespace on fields intact, but collapse the rest to standard patterns. The scheme allows for various canonicalisation transforms and various signing algorithms.
Java JAX-WS.
W3C digital signatures are contained in a sandwich like this:

I have not studied these deeply enough to know if some of them are just different names for the same scheme.

Learning More

Oracle’s Java 1.8 documentation on : Java XML Digital Signature API : Not Oasis-style

Apache Axis Rampart
Apache Santuario
HMAC
JAX-WS
Oasis
PAD
Sample Code to compute a HMAC
SOAP
W3C XML signing
Wikipedia on XML signing
WSDP
WSS4J

standard footer
	This page is posted on the web at:	http://mindprod.com/jgloss/xmlsigning.html
	Optional Replicator mirror of mindprod.com on local hard disk J:	J:\mindprod\jgloss\xmlsigning.html
	Please read the feedback from other visitors, or send your own feedback about the site. Contact Roedy. Please feel free to link to this page without explicit permission.
	Canadian Mind Products IP:[65.110.21.43] Your face IP:[44.201.72.250]
Feedback	You are visitor number