XML Security Library

Home Download GitHub News Documentation FAQ Tutorial API reference Examples XML Digital Signature XML Encryption XML Canonicalization Reporting Bugs Mailing list Related Authors
# XML Security Library XML Security Library is a C library based on LibXML2. The library supports major XML security standards: XML Signature XML Encryption Canonical XML (part of the LibXML2) Exclusive Canonical XML (part of the LibXML2) XML Security Library is released under the MIT Licence see the Copyright file in the distribution for details. News April 2, 2026 The XML Security Library 1.3.10 release includes the following changes: The minimum supported versions for dependencies are now: LibXML2 >= 2.9.13 (February 19, 2022), LibXSLT >= 1.1.35 (February 16, 2022), OpenSSL >= 3.0.13 (January 30, 2024), LibreSSL >= 3.9.0 (March 9, 2024), NSS >= 3.91 (June 26, 2023), NSPR >= 4.34.1 (June 26, 2023), GnuTLS >= 3.8.3 (January 1, 2024). (xmlsec-core) Disabled all key value data for all key types by default (use '--enabled-key-data' flag to re-enable if needed). (xmlsec-core) Added '--enable-asn1-signatures-hack' option to allow generation / verification of ASN1 signature values. (xmlsec-core) Added '--verify-crls' option to verify CRLs when loading from command line. (xmlsec-openssl) Added support for EdDSA signature algorithm; XDH (X25519 and X448) key agreement algorithms; HKDF key derivation algorithm; Camellia block cipher and key wrap algorithms; ChaCha20 and ChaCha20-Poly1305 encryption algorithms; and experimental ML-DSA and SLH-DSA-SHA2 signature algorithms. (xmlsec-gnutls) Added support for EdDSA signature algorithms; ECDH and XDH (X25519 and X448) key agreement algorithms; ConcatKDF, PBKDF2, and HKDF key derivation algorithms; ChaCha20 and ChaCha20-Poly1305 encryption algorithms; SHA2-224 and SHA3-224 digest algorithms; and experimental support for ML-DSA signature algorithms. (xmlsec-nss) Added support for EdDSA (Ed25519) signature algorithms; ECDH and XDH (X25519) key agreement algorithms; ConcatKDF and HKDF key derivation algorithms; and ChaCha20-Poly1305 encryption algorithm. Camellia block cipher and key wrap algorithms. (xmlsec-mscng) Added support for DSA-SHA256 signature algorithm; XDH (X25519) and DH (X9.42 DHX) key agreement algorithms; HKDF key derivation algorithm; and SHA3 digest algorithms. (xmlsec-mscng) Added support for loading CRLs from command line. (xmlsec-test) Created scripts to generate keys, regenerated all keys with standard names, and updated tests accordingly. Several other small fixes (see more details). November 10, 2025 The XML Security Library 1.3.9 release includes the following changes: (xmlsec-openssl) Added pub/priv key type check for EC and DH keys; improved non-memory EVP keys detection. (xmlsec-openssl) Fixed memory leak in X509 certs verification code. (xmlsec-openssl) Added octet parser in X509 names. (xmlsec-msncg) Added support for non-persistent PKCS12 keys. (xmlsec-windows) Simplified windows build and removed 'with-dl' option for 'configure.js'. Several other small fixes (see more details). October 15, 2025 The XML Security Library 1.3.8 release includes the following changes: (xmlsec-openssl) Deprecated support for OpenSSL 1.1.1 (reached its End of Life in September, 2023). (xmlsec-openssl) Added AWS-LC support. (xmlsec-openssl, xmlsec-gnutls, xmlsec-mscng) Added support for longer than expected DSA and ECDSA sigantures to support broken Java implementations. (xmlsec command line tool) Added option "--add-id-attr" to add ID attributes by name to all nodes in the document. (xmlsec-core) Added RSA MGF1 and digest template API. (xmlsec-core) Added example of signing / verifying signature by ID attribute. Several other small fixes (see more details). June 16, 2025 The legacy XML Security Library 1.2.42 release includes the following changes: (xmlsec-openssl) Ensured that only certificates from XML file are returned after verification. (xmlsec-core) Fixed includes to support latest LibXML2 / LibXSLT. Several other small fixes (see more details). February 11, 2025 The XML Security Library 1.3.7 release includes the following changes: (xmlsec-core) Added XMLSEC_TRANSFORM_FLAGS_USER_SPECIFIED flag to the xmlSecTransform to differentiate transforms specified in the input XML file vs transforms automatically added by XMLSec library. (xmlsec-core) Added signature result verification to the examples to demonstrate the need to ensure the correct data is actually signed. (xmlsec-core) Disabled old crypto algorithms (MD5, RIPEMD160) and the old crypto engines (MSCrypto, GCrypt) by default (use "--with-legacy-features" option to reenable everything). (xmlsec-openssl) Fixed excess padding in ECDSA signature generation. (xmlsec-openssl) Fixed build warnings for BoringSSL / AWS-LC. (xmlsec-nss) Fixed certificates search in NSS DB. (xmlsec-openssl, xmlsec-gnutls, xmlsec-mscng) Added an option to skip timestamp checks for certificates and CLRs. (xmlsec-windows) Disabled old crypto algorithms (MD5, RIPEMD160), made "mscng" the default crypto engine on Windows, and added support for "legacy-features" flag for "configure.js". Several other small fixes (see more details). October 22, 2024 The XML Security Library 1.3.6 release includes the following changes: (xmlsec-openssl) Fixed build if OpenSSL 3.0 doesn't have engines support enabled. (xmlsec-mscng, xmlsec-mscrypto) Added support for multiple trusted certs with the same subject. (windows) Disabled iconv support by default (use 'iconv=yes' option for 'configure.js' to re-enable it). Several other small fixes (see more details). July 19, 2024 The XML Security Library 1.3.5 and legacy 1.2.41 releases include the following changes: (xmlsec-mscng,xmlsec-mscrypto) Improved certificates verification. (xmlsec-gnutls) Added support for self-signed certificates. (xmlsec-core) Fix deprecated functions in LibXML2 2.13.1 including disabling HTTP support by default (use ''--enable-http' option to re-enable it). Several other small fixes (see more details). July 11, 2024 The legacy XML Security Library 1.2.40 release includes the following changes: (xmlsec-core) Fixed functions deprecated in LibXML2 2.13.1 (including disabling HTTP support by default). (xmlsec-nss) Increased keys size in all tests to support NSS 3.101. (windows) Added "ftp" and "http" flags in 'configure.js' (both are disabled by default). Several other small fixes (more details). April 9, 2024 The XML Security Library 1.3.4 release includes the following changes: (xmlsec-openssl) Support cert dates before unix epoch start. (xmlsec-openssl) Fix build for LibreSSL or BoringSSL. (xmlsec-nss) Ensure NSS algorithms are initialized. Several other small fixes (see more details). News page