Signing nested XML nodes with detached method

Open
#157 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
python
Domain
cryptography, security

Research direction

Start by reproducing the nested detached-signature example with the Envelope, Set, and Document nodes, preserving the namespace declarations and signing inner nodes before their container. Investigate the verification failure and define done as all three references verifying successfully without changing the schema-required namespaces.

Written by the indexing model from the issue text.

Description

Hi
I'm trying to sign an XML document with detached method, but i require to sign several tags and the tag containing its. Something like this:

<Envelope version="1.0" xsi:schemaLocation="http://example.org/MySite Document_v1.xsd" xmlns="http://example.org/MySite" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
     <Set ID="setid">
              <Document ID="doc1">    
              </Document>
              <Signature>...<Reference URI="#doc1">...</Signature>
              <Document ID="doc2">    
              </Document>
              <Signature>...<Reference URI="#doc2">...</Signature>
     </Set>
     <Signature>...<Reference URI="#setid">...</Signature>
</Envelope>

Of course i do it one by one, the inner tags first and the Set tag the latest.
But when I verify the signature get Bad Signature Error.
After reading and test the code my best guest is that the namespace added to the 'Envelope' tag propagate to the children nodes and the signature don't match or something.
The XML has to comply with an schema and can't remove namespace declarations.

Dominant language
Python
Stars
154
Forks
113
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from XML-Security/signxml

All issues in XML-Security/signxml

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.