signedandenveloped

Signedandenveloped is a term used in digital signature technology to describe a signature that is embedded inside the document it signs. In XML Digital Signature, this arrangement is commonly implemented as an enveloped signature, where the Signature element is placed within the signed XML data itself.

How it works

In an enveloped signature the signature is included in the same document that is being signed. During signing, a transform labeled enveloped-signature is applied, which ensures that the Signature element itself is excluded from the data being signed. The result is a single document in which the Signature element resides inside the content it authenticates. Recipients locate the Signature element within the document to verify integrity and origin.

Standards and usage

The enveloped signature approach is defined in the XML Signature standards maintained by W3C. It is widely used in XML-based messaging and protocols, such as SOAP messages and certain WS-Security scenarios, where transmitting a single, self-contained signed document is desirable. The method is compatible with public-key cryptography and standard digest and canonicalization procedures.

Advantages and limitations

Advantages include convenient transmission and self-contained integrity protection of the entire document. Limitations include the need for careful canonicalization and processing to avoid circular references, and potential complications if the document structure changes in ways that affect how the Signature element is located or validated. Proper implementation is essential to prevent tampering of surrounding content and to ensure compatibility across signing and verification systems.

See also

XML Signature, enveloped signature, enveloping signature, detached signature.