XML Security Library: XML Digital Signature

Home Download GitHub News Documentation FAQ Tutorial API reference Examples XML Digital Signature XML Encryption XML Canonicalization Reporting Bugs Mailing list Related Authors
## XML Digital Signature Interoperability Report XML Security library supports the following features as defined in XML Signature Syntax and Processing 1.1 (also see RFC 9231): ### XMLSec Library core features
| Requirements | Status
Processing rules
Reference Generation | Required | Yes
Signature Generation | Required | Yes
Reference Validation | Required | Yes
Signature Validation | Required | Yes
Syntax
The ds:CryptoBinary Simple Type | Required | Yes
The Signature Element | Required | Yes
The SignatureValue Element | Required | Yes
The SignedInfo Element | Required | Yes
The CanonicalizationMethod Element | Required | Yes
The SignatureMethod Element | Required | Yes
The Reference Element | Required | Yes
The Reference Element: URI Attribute | Required | Yes
The Transforms Element | Optional | Yes
The DigestMethod Element | Required | Yes
The DigestValue Element | Required | Yes
The KeyInfo Element | Optional | Yes
The KeyName Element | Optional | Yes
The KeyValue Element | Optional | Yes (disabled by default; also see algorithms section)
The RetrievalMethod Element | Optional | Yes
The MgmtData Element | NOT RECOMMENDED and SHOULD NOT be used | Yes
XML Encryption EncryptedKey and DerivedKey Elements | Optional | Yes (see XML Encryption report)
The KeyInfoReference Element | Optional | Yes
The Object Element | Optional | Yes (only the Manifest element is supported)
The Manifest Element | Optional | Yes
The SignatureProperties Element | Optional | No (ignored)
Transforms
Canonical XML 1.0 (C14N) omit comments | Required | Yes
Canonical XML 1.0 (C14N) with comments | Recommended | Yes
Canonical XML 1.1 (C14N11) omit comments | Required | Yes
Canonical XML 1.1 (C14N11) with comments | Recommended | Yes
Exlusive Canonical XML 1.0 (EXC-C14N) omit comments | Required | Yes
Exlusive Canonical XML 1.0 (EXC-C14N) with comments | Recommended | Yes
Base64 Transform | Required | Yes
XPath Filtering | Recommended | Yes
XPath Filter 2.0 | Recommended | Yes
Enveloped Signature Transform | Required | Yes
XSLT Transform | Optional | Yes (2)
Decryption Transform | Optional | Yes
XPointer Transform | Optional | Yes
### XMLSec Cryptographic Libraries features
| Requirements | XMLSec with OpenSSL | XMLSec with NSS | XMLSec with GnuTLS | XMLSec with MSCng | XMLSec with MSCrypto (1) | XMLSec with GCrypt (1)
Message Digests
SHA-1 | Required (use is DISCOURAGED) | Yes | Yes | Yes | Yes | Yes | Yes
SHA2-224 | Optional | Yes | Yes | No | No | No | No
SHA2-256 | Required | Yes | Yes | Yes | Yes | Yes | Yes
SHA2-384 | Optional | Yes | Yes | Yes | Yes | Yes | Yes
SHA2-512 | Optional | Yes | Yes | Yes | Yes | Yes | Yes
SHA3-224 | Optional | Yes | No | No | No | No | No
SHA3-256 | Optional | Yes | No | Yes | No | No | Yes
SHA3-384 | Optional | Yes | No | Yes | No | No | Yes
SHA3-512 | Optional | Yes | No | Yes | No | No | Yes
RIPEMD160 | DEPRECATED | Yes (1) | No | No | No | No | Yes (1)
GOST-R3411-94 | Optional | Yes (3) | No | Yes | No | Yes (4) | No
GOST-R3411-2012 (256 bit) | Optional | Yes (3) | No | Yes | No | Yes (4) | No
GOST-R3411-2012 (512 bit) | Optional | Yes (3) | No | Yes | No | Yes (4) | No
MD5 | DEPRECATED | Yes (1) | Yes (1) | Yes (1) | Yes (1) | Yes (1) | Yes (1)
Message Authentication Codes
HMAC-SHA1 | Required (use is DISCOURAGED) | Yes | Yes | Yes | Yes | Yes | Yes
HMAC-SHA2-224 | Optional | Yes | Yes | No | No | Yes | No
HMAC-SHA2-256 | Required | Yes | Yes | Yes | Yes | Yes | Yes
HMAC-SHA2-384 | Recommended | Yes | Yes | Yes | Yes | Yes | Yes
HMAC-SHA2-512 | Recommended | Yes | Yes | Yes | Yes | Yes | Yes
HMAC-RIPEMD160 | DEPRECATED | Yes (1) | Yes (1) | No | No | No | Yes (1)
HMAC-MD5 | DEPRECATED | Yes (1) | Yes (1) | No | Yes (1) | Yes (1) | Yes (1)
Signatures
DSA-SHA1 | Required (use is DISCOURAGED for signature generation) | Yes | Yes | Yes | Yes | Yes | Yes
DSA-SHA256 | Optional | Yes | Yes | Yes | No | No | No
PKCS1 RSA-SHA1 | Recommended (use is DISCOURAGED for signature generation) | Yes | Yes | Yes | Yes | Yes | Yes
PKCS1 RSA-SHA2-224 | Optional | Yes | Yes | No | No | No | No
PKCS1 RSA-SHA2-256 | Required | Yes | Yes | Yes | Yes | Yes | Yes
PKCS1 RSA-SHA2-384 | Optional | Yes | Yes | Yes | Yes | Yes | Yes
PKCS1 RSA-SHA2-512 | Optional | Yes | Yes | Yes | Yes | Yes | Yes
PKCS1 RSA-RIPEMD160 | DEPRECATED | Yes (1) | No | No | No | No | Yes (1)
PKCS1 RSA-MD5 | DEPRECATED | Yes (1) | Yes (1) | No | Yes (1) | Yes (1) | Yes (1)
ECDSA-RIPEMD160 | DEPRECATED | Yes (1) | No | No | No | No | No
ECDSA-SHA1 | Optional (use is DISCOURAGED) | Yes | Yes | Yes | Yes | No | Yes
ECDSA-SHA2-224 | Optional | Yes | Yes | No | No | No | No
ECDSA-SHA2-256 | Required | Yes | Yes | Yes | Yes | No | Yes
ECDSA-SHA2-384 | Optional | Yes | Yes | Yes | Yes | No | Yes
ECDSA-SHA2-512 | Optional | Yes | Yes | Yes | Yes | No | Yes
ECDSA-SHA3-224 | Optional | Yes | No | No | No | No | No
ECDSA-SHA3-256 | Optional | Yes | No | Yes | No | No | Yes
ECDSA-SHA3-384 | Optional | Yes | No | Yes | No | No | Yes
ECDSA-SHA3-512 | Optional | Yes | No | Yes | No | No | Yes
RSASSA-PSS-SHA1 without Parameters | Optional (use is DISCOURAGED) | Yes | Yes | No | Yes | No | Yes
RSASSA-PSS-SHA2-224 without Parameters | Optional | Yes | Yes | No | No | No | No
RSASSA-PSS-SHA2-256 without Parameters | Optional | Yes | Yes | Yes | Yes | No | Yes
RSASSA-PSS-SHA2-384 without Parameters | Optional | Yes | Yes | Yes | Yes | No | Yes
RSASSA-PSS-SHA2-512 without Parameters | Optional | Yes | Yes | Yes | Yes | No | Yes
RSASSA-PSS-SHA3-224 without Parameters | Optional | Yes | No | No | No | No | No
RSASSA-PSS-SHA3-256 without Parameters | Optional | Yes | No | No | No | No | Yes
RSASSA-PSS-SHA3-384 without Parameters | Optional | Yes | No | No | No | No | Yes
RSASSA-PSS-SHA3-512 without Parameters | Optional | Yes | No | No | No | No | Yes
GOST-R3410-2001 | Optional | Yes (3) | No | Yes | No | Yes (4) | No
GOST-R3410-2012 (256 bit) | Optional | Yes (3) | No | Yes | No | Yes (4) | No
GOST-R3411-2012 (512 bit) | Optional | Yes (3) | No | Yes | No | Yes (4) | No
The KeyInfo Element
The DSAKeyValue Element | Optional | Yes (5) (1) | Yes (5) (1) | Yes (5) (1) | Yes (5) (1) | Yes (5) (1) | Yes (5) (1)
The RSAKeyValue Element | Optional | Yes (1) | Yes (1) | Yes (1) | Yes (1) | Yes (1) | Yes (1)
The ECKeyValue Element | Optional | Yes (1) | Yes (1) | Yes (1) | Yes (1) | No | Yes
The DHKeyValue Element | Optional | Yes (1) | No | No | No | No | No
The X509Data Element | Optional | Yes | Yes | Yes | Yes | Yes | No
The X509Digest Element | Optional | Yes | Yes | Yes | Yes (6) | No | No
The PGPData Element | Optional | No | No | No | No | No | No
The SPKIData Element | Optional | No | No | No | No | No | No
The DEREncodedKeyValue Element | Optional | Yes (1) | Yes (1) | Yes (1) | Yes (1) | No | No
(1) The feature is disabled by default but can be re-enabled at build time. (2) Requires LibXSLT library. (3) GOST support for the xmlsec-openssl library requires installation of the GOST OpenSSL Engine. (4) GOST support for the xmlsec-mscrypto library requires installation of a GOST CSP. (5) Seed and PgenCounter are not supported in DSAKeyValue element. (6) The xmlsec-mscng library only supports SHA1 digest algorithm for X509Digest element. ### Test vectors XML Signature 1.0 interop (2001) XML Signature 1.1 interop (2012)