I have checked the XML Signature Syntax and Processing on W3C website, however it says little about multi-signature. Is there a standard or rule to create multi-signature on one single xml file? Thank you
Example:(Consider Only same-file referencing)
Original xml
<root>
<item>
<name>Apple</name>
<price>100</price>
</item>
</root>
First A signs it with an enveloped signature
A Signed XML
<root>
<item>
<name>Apple</name>
<price>100</price>
</item>
<Signature>this is Signature signed by A with Ref URL=""</Signature>
</root>
Now, B wants to sign the XML (containing A's signature)
B Signed XML
<root>
<item>
<name>Apple</name>
<price>100</price>
</item>
<Signature>Signature A: this is Signature signed by A with Ref URL=""</Signature>
<Signature>Signature B: this is Signature signed by B with Ref URL=""</Signature>
</root>
then when it comes to verifying, it becomes confusing...
for Signature A, while verifying, it sees
<root>
<item>
<name>Apple</name>
<price>100</price>
</item>
<Signature>Signature B: this is Signature signed by B with Ref URL=""</Signature>
</root>
but what it actually signed is
<root>
<item>
<name>Apple</name>
<price>100</price>
</item>
</root>
(note that because of enveloped transform, one's signature node is removed while signing and verfying) The same problem might be solved by treating Signature node as root when doing enveloping signature. But if multiple references involved, it might become more complicated.
There is no problem in making several signatures over one set of nodes and including them into the same XML document using current XMLDSig standard. There are no special rules or standards needed.
With your sample, each signature is (should be) made not over "root", but over "item" node (or set of item nodes). Consequently signature B doesn't cover signature A as data to be signed.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With