envelopedsignature

Enveloped signature is a type of XML Digital Signature in which the Signature element is embedded within the XML data it signs. The signature is computed over the content of the document, excluding the Signature element itself, which is removed from the data prior to digest computation. This exclusion is achieved through the enveloped-signature transform, identified by the URI http://www.w3.org/2000/09/xmldsig#enveloped-signature. As a result, the Signature element appears as a child within the signed data, commonly placed inside the element that is being signed.

In practice, an enveloped signature allows the signed document to carry its own proof of integrity and authenticity without requiring external references. Verification applies the same transforms, reconstituting the data with the Signature element excluded and validating the digital signature against the signer’s public key. This pattern is widely used in XML-based systems such as SOAP messages, SAML assertions, and signed XML documents that need a compact, locally verifiable signature.

Key considerations include the placement of the Signature element to avoid altering the part of the document that is being signed, and the correct use of the enveloped-signature transform to prevent a circular signature. References typically cover the portion of the document that remains after removing the Signature element. Security implications involve ensuring robust canonicalization, proper key management, and alignment with other integrity protections.

Related concepts include enveloping signatures (where the signed data is carried inside the Signature element) and detached signatures (where the signature is separate from the data). Enveloped signatures are defined within the XML Signature standard (XML-Signature Syntax and Processing) by the W3C.