Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is there a standard for XML multi-signature?

I have checked the XML Signature Syntax and Processing on W3C website, however it says little about multi-signature. Is there a standard or rule to create multi-signature on one single xml file? Thank you

Example:(Consider Only same-file referencing)

Original xml

<root>
  <item>
    <name>Apple</name>
    <price>100</price>
  </item>
</root>

First A signs it with an enveloped signature

A Signed XML

<root>
  <item>
    <name>Apple</name>
    <price>100</price>
  </item>
  <Signature>this is Signature signed by A with Ref URL=""</Signature>
</root>

Now, B wants to sign the XML (containing A's signature)

B Signed XML

<root>
  <item>
    <name>Apple</name>
    <price>100</price>
  </item>
  <Signature>Signature A: this is Signature signed by A with Ref URL=""</Signature>
  <Signature>Signature B: this is Signature signed by B with Ref URL=""</Signature>
</root>

then when it comes to verifying, it becomes confusing...

for Signature A, while verifying, it sees

<root>
  <item>
    <name>Apple</name>
    <price>100</price>
  </item>
  <Signature>Signature B: this is Signature signed by B with Ref URL=""</Signature>
</root>

but what it actually signed is

<root>
  <item>
    <name>Apple</name>
    <price>100</price>
  </item>
</root>

(note that because of enveloped transform, one's signature node is removed while signing and verfying) The same problem might be solved by treating Signature node as root when doing enveloping signature. But if multiple references involved, it might become more complicated.

like image 749
iOS Padawan Avatar asked Oct 07 '22 15:10

iOS Padawan


1 Answers

There is no problem in making several signatures over one set of nodes and including them into the same XML document using current XMLDSig standard. There are no special rules or standards needed.

With your sample, each signature is (should be) made not over "root", but over "item" node (or set of item nodes). Consequently signature B doesn't cover signature A as data to be signed.

like image 99
Eugene Mayevski 'Callback Avatar answered Oct 18 '22 10:10

Eugene Mayevski 'Callback