XMLDSig:我是否必须在封装签名中指定引用URI

Question

假设我有这样的xml:

<?xml version="1.0" encoding="UTF-8"?>
<CATALOG>
    <CD>
        <TITLE>Empire Burlesque</TITLE>                    
        <ARTIST>Bob Dylan</ARTIST>
        <COUNTRY id="123">USA</COUNTRY>
        <COMPANY>Columbia</COMPANY>
        <PRICE>10.90</PRICE>
        <YEAR>1985</YEAR>
    </CD>    
    <CD>
        <TITLE>Hide your heart</TITLE>
        <ARTIST>Bonnie Tyler</ARTIST>
        <COUNTRY>UK</COUNTRY>
        <COMPANY>CBS Records</COMPANY>
        <PRICE>9.90</PRICE>
        <YEAR>1988</YEAR>
    </CD>
    <CD>
        <TITLE>Greatest Hits</TITLE>
        <ARTIST>Dolly Parton</ARTIST>
        <COUNTRY>USA</COUNTRY>
        <COMPANY>RCA</COMPANY>
        <PRICE>9.90</PRICE>
        <YEAR>1982</YEAR>
    </CD>   
</CATALOG>

签字后我得到:

<?xml version="1.0" encoding="UTF-8"?>
<CATALOG>
    <CD>
        <TITLE>Empire Burlesque</TITLE>                    
        <ARTIST>Bob Dylan</ARTIST>
        <COUNTRY id="123">USA</COUNTRY>
        <COMPANY>Columbia</COMPANY>
        <PRICE>10.90</PRICE>
        <YEAR>1985</YEAR>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-md5"/>
                <ds:Reference URI="">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#md5"/>
                    <ds:DigestValue>C6i9GSNZ8seoXxfuFc482Q==</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>
d/ufAnYK35PKUdi+O6DUytV+36OGAr5meHXq2qoOUp+zO1Q5HbJvIs01qlPT9oKiBEi2QiAF3Sya
ZVwi4hEI9xHkLiewmOxPo1KgVfJ1Ir2RPpkdegFYFx9QCMR4Z1M7zTkijCKv9ncWR4MYjOAfDrKf
fbvUX3AbRHlUYJj6M4QcrQUuBPhSqo4TcxtfblNqmKUT+141+sLSsuM2xy24YeyF7NUff9tirCiP
KgBHpFGtiJAdxugAlzqHaR9CP2kRA2Sg046NBo2yO/nTDfUKqquZm4aaZsLWbvKJYvrgqD4YgH4M
FFpK5ChgYa4oi7f9BAYxOFcY9f1OCHsvpdCbpw==
            </ds:SignatureValue>
            <ds:KeyInfo>
                <ds:KeyValue>
                    <ds:RSAKeyValue>
                        <ds:Modulus>
1Bphf/ypmjIyIbWKBS39IaBpUn/e7oylpexMhTtsKYnbKuufzDhReR15oJ9cavVa9BkSSmLjaLxt
jIzIswaoW0SnTR4VySpbkujoeCSzoIGTlQ2ae96vT4sZURferQ8GpS/iExpblSX5knD8TBDCt+MK
UNTpJzPy6HdYGBtKfcc5C0STt07WGnhnOYYrIht1y/blne2Ec90dCt3hQmInqbBUbp1Ngl4V7xXH
rSifvQ6X+Dzg10l/vx92vFwBM3we+7p8jbDey9KLWS44W/AXmcxmuBo4kTN4fS9Ld/ctMR7ATbP2
frjcHJoecsQs3tnK1VZjrnnQUsZxDqjWhYDx2w==
                        </ds:Modulus>
                        <ds:Exponent>AQAB</ds:Exponent>
                    </ds:RSAKeyValue>
                </ds:KeyValue>
                <ds:X509Data>
                    <ds:X509Certificate>
MIICwTCCAamgAwIBAgIITKhEP4iHnaQwDQYJKoZIhvcNAQENBQAwDjEMMAoGA1UEAwwDa2V5MB4X
DTE1MDQwMjIxMDAxN1oXDTI1MDQwMjIxMDAxN1owDjEMMAoGA1UEAwwDa2V5MIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCfKCAQEA1Bphf/ypmjIyIbWKBS39IaBpUn/e7oylpexMhTtsKYnbKuuf
zDhReR15oJ9cavVa9BkSSmLjaLxtjIzIswaoW0SnTR4VySpbkujoeCSzoIGTlQ2ae96vT4sZURfe
rQ8GpS/iExpblSX5knD8TBDCt+MKUNTpJzPy6HdYGBtKfcc5C0STt07WGnhnOYYrIht1y/blne2E
c90dCt3hQmInqbBUbp1Ngl4V7xXHrSifvQ6X+Azg10l/vx92vFwBM3we+7p8jbDey9KLWS44W/AX
mcxmuBo4kTN4fS9Ld/ctMR7ATbP2frjcHJoecsQs3tnK1VZjrnnQUsZxDqjWhYDx2wIDAQABoyMw
ITAOBgNVHQ8BAf8EBAMCBLAwDwYDVR0TAQH/BAUwAwEBADANBgkqhkiG9w0BAQ0FAAOCAQEAa3VI
zBGyt7mfHh9g9hAKYxUHkrPjiOQDoE3QP/2aZQlGMeD8OwgjZHA4d2iXLLOJt56lgQenEO2nFLxE
/SSEc4eOFHYR170W7eRuEqIByZhtu1DDMzCVzxTF/Gu/WtTeQzhu4q1Pl9zUyYeHhLIO+HzLJCn0
O2y6tD/E6zqqzPFSW1oXuISM4ZvFR+0wQgdgYMJa5JU6XwPvS2+7y2B28JFBUq90S4a4FVj65UT5
qrcgzi4Z2YF2phAD7Jkq3Oqdedmh9q1mg2VFg7v2/Kn+McTLSb0uX7svXMOr2IhZ1FppziQYx3UN
XPrBbbomwNITW6R56wCmB2nAcp93f9xrKw==
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
    </CD>    
    <CD>
        <TITLE>Hide your heart</TITLE>
        <ARTIST>Bonnie Tyler</ARTIST>
        <COUNTRY>UK</COUNTRY>
        <COMPANY>CBS Records</COMPANY>
        <PRICE>9.90</PRICE>
        <YEAR>1988</YEAR>
    </CD>
    <CD>
        <TITLE>Greatest Hits</TITLE>
        <ARTIST>Dolly Parton</ARTIST>
        <COUNTRY>USA</COUNTRY>
        <COMPANY>RCA</COMPANY>
        <PRICE>9.90</PRICE>
        <YEAR>1982</YEAR>
    </CD>   
</CATALOG>

这是否在事实上<Signature>被笼罩下,<CD>意味着它签署完全元素,或者因为<ds:Reference URI="">它意味着整个XML签署？通过阅读规范http://www.w3.org/TR/xmldsig-core/,我留下的印象是封装签名不需要参考URI.它是否正确？

Answer 1

我想我明白了.

根据规范,URI =""

标识包含签名的XML资源的节点集(减去任何注释节点)

我理解为"标识包含该<ds:Signature>元素的XML文档的所有节点(节点集).这意味着URI =""<=> signed是整个文档.

此声明由另一个资源支持- Apache Santuario FAQ:

3.1.什么是包围变换？包络变换是一种特殊变换,可以使用所谓的封装签名.

包含的签名是整个XML文档的签名,元素包含在文档本身中.一个例子可能是:

<![CDATA[
<?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?>
   <Root>
     <SomeContent>
       ... 
     </SomeContent>
       <ds:Signature>
         <ds:SignedInfo>
           <ds:Reference URI="">
             <ds:Transforms>
               <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
             </ds:Transforms>
           </ds:Reference>
         </ds:SignedInfo>
         ....
       </ds:Signature>
   </Root>
]]>

Reference表示Root及其后代(注释除外)是有符号的,但Transform元素表示要从要签名的流中抛出Signature元素(即此Reference的父元素).请注意,如果Root中有其他Signature元素,它们将保持不变.

...转换为"URI =""签名的是包含该文件的整个文件,<ds:Signature>我们有一个<ds:Transform>说明此签名被封装的文件,因此应在验证前删除"

因此,结论是:URI =""和签名类型(分离,包围,包络)是两个完全不同的东西.URI是指向XML文档的一部分的指针,这些部分表示签名的内容和不签名的内容.URI =""表示<ds:Signature>正在签署整个当前文档(包含的文档).签名类型(分离,包围,包络)otoh会影响在验证之前应该应用的转换.如果有包装,<ds:Signature>必须在验证前将整体移除.