XML Signature in Web Services. -
09-04-2007
, 07:00 AM
According to the technical article "Understanding XML Digital Signature", the
author mentions that the
"At this point, we know how to refer to content, transform and hash it, and
create a signature that covers (protects) that content. Recall that content
is protected by using indirection: the ds:SignatureValue covers the
ds:SignedInfo, which contains ds:References that contain the digest values of
the application data. Change any of those things, and the chain of math
computations is broken, and the signature won't verify."
I have tried to sign a SOAP XML and have been able to so successfully..I am
unable to understand the following, though.
a. From the signed XML, I can see that the ds:References contains a digest
value which is SHA1 generated. I also see the ds:SignatureValue element
containing a value..
Is the SignatureValue element contain the signature emcompassing the
ds:SignedInfo element? If yes, how is this signature generated? And secondly,
what is the need for the signature?
Regards,
Chetan Viswanath |