Oxygen XML Author plugin 13.2.0

Digital Signatures | 372OverviewDigital signatures are widely used as security tokens, not just in XML. A digital signature provides a mechanism forassuring integrity of data, the authentication of its signer, and the non-repudiation of the entire signature to an externalparty:• A digital signature must provide a way to verify that the data has not been modified or replaced to ensure integrity.• The signature must provide a way to establish the identity of the data's signer for authentication.• The signature must provide the ability for the data's integrity and authentication to be provable to a third party fornon-repudiation.A public key system is used to create the digital signature and it's also used for verification. The signature binds thesigner to the document because digitally signing a document requires the originator to create a hash of the message andthen encrypt that hash value with his own private key. Only the originator has that private key and he is the only onethat can encrypt the hash so that it can be unencrypted using his public key. The recipient, upon receiving both themessage and the encrypted hash value, can decrypt the hash value, knowing the originator's public key. The recipientmust also try to generate the hash value of the message and compare the newly generated hash value with the unencryptedhash value received from the originator. If the hash values are identical, it proves that the originator created the message,because only the actual originator could encrypt the hash value correctly.XML Signatures can be applied to any digital content (data object), including XML (see W3C Recommendation,XML-Signature Syntax and Processing ). An XML Signature may be applied to the content of one or more resources:• enveloped or enveloping signatures are applied over data within the same XML document as the signature• detached signatures are applied over data external to the signature element; the signature is "detached" from thecontent it signs. This definition typically applies to separate data objects, but it also includes the instance where thesignature and data object reside within the same XML document but are sibling elements.The XML Signature is a method of associating a key with referenced data. It does not normatively specify how keysare associated with persons or institutions, nor the meaning of the data being referenced and signed.The original data is not actually signed. Instead, the signature is applied to the output of a chain of canonicalization andtransformation algorithms, which are applied to the data in a designated sequence. This system provides the flexibilityto accommodate whatever "normalization" or desired preprocessing of the data that might be required or desired beforesubjecting it to being signed.To canonicalize something means to put it in a standard format that everyone generally uses. Because the signature isdependent on the content it is signing, a signature produced from a not canonicalized document could possibly be differentfrom one produced from a canonicalized document. The canonical form of an XML document is physical representationof the document produced by the method described in this specification. The term canonical XML refers to XML thatis in canonical form. The XML canonicalization method is the algorithm defined by this specification that generates thecanonical form of a given XML document or document subset. The term XML canonicalization refers to the process ofapplying the XML canonicalization method to an XML document or document subset. XML canonicalization is designedto be useful to applications that require the ability to test whether the information content of a document or documentsubset has been changed. This is done by comparing the canonical form of the original document before applicationprocessing with the canonical form of the document result of the application processing.A digital signature over the canonical form of an XML document or document subset would allows the signature digestcalculations to be oblivious to changes in the original document's physical representation. During signature generation,the digest is computed over the canonical form of the document. The document is then transferred to the relying party,which validates the signature by reading the document and computing a digest of the canonical form of the receiveddocument. The equivalence of the digests computed by the signing and relying parties (and hence the equivalence ofthe canonical forms over which they were computed) ensures that the information content of the document has not beenaltered since it was signed.The following canonicalization algorithms are used in Oxygen XML Author plugin : Canonical XML (or InclusiveXML Canonicalization)(XMLC14N) and Exclusive XML Canonicalization(EXCC14N). The first is used for XML wherethe context doesn't change while the second was designed for canonicalization where the context might change.