XMLsignature

XMLSignature, formally XML Signature Syntax and Processing, is a W3C standard for digital signatures of XML data. It provides integrity, authentication, and non-repudiation for XML messages and documents, independent of the transport protocol used to carry them.

The core structure consists of a Signature element that contains SignedInfo, SignatureValue, and optionally KeyInfo (which may include key material or certificates). SignedInfo lists one or more Reference elements. Each Reference identifies a portion of the document to be signed and specifies a DigestMethod and DigestValue that are computed over the data after optional Transforms are applied. Transforms can alter the data before digest, such as for canonicalization or removing the signature itself (enveloped-signature).

A SignatureValue is produced by signing the canonicalized SignedInfo with a private key using a SignatureMethod (for example RSA, DSA, or ECDSA). The resulting value is stored in the Signature element. Verification is the reverse: the verifier computes the digest of the referenced data, checks the DigestValue, then validates the SignatureValue with the corresponding public key. If the validation passes, the signer is authenticated and data integrity is ensured.

XMLSignature supports different packaging: enveloped (the signature sits inside the document being signed), enveloping (the data is inside the Signature), and detached (the signature is separate from the data). It is widely used in web services, SSO, and XML-based workflows, and is commonly paired with XML Encryption for confidentiality or with X509 Certificates in KeyInfo.

Security considerations include risks such as signature wrapping and misconfiguration of transforms or references. Proper canonicalization, strict reference validation, and secure key management are essential. The standard is maintained by the W3C as part of the XML Signature family.