Transform: enveloped-signed

["Frank. Christopher" <C....@seeburger.de>]

Onk!

I am (again;-) a bit confused. I was checking out the XMLDS specification which clearly says that on the transform: http://www.w3.org/2000/09/xmldsig#enveloped-signature 

	"The Enveloped Signature transform removes the Signature element from the calculation of the signature when the signature is within the content that it is being signed..."

So if I sign my XML (using enveloped-signature by "addTransform" using the offered statics for enveoped signature prior to "sign"). Works fine.

Then change the content of the 'Signature' element by adding a attribute or whatsoever: you will see, works fine too. (as expected).

Then change content of the 'SignedInfo' by adding a attribute (or ANY other tag within the 'Signature' structure) and you will see the verification fails. (If you only add whitespaces within the tags (< to >), that works fine too.

Additionally, if you add ANY whitespace before or after the tags within the 'Signature' structure, the signature gets invalid too. (that was the way I mentioned it because I tried to reformat it to let it look better;-)

As a conclusion I would guess ONLY the Signature element itself is excluded from signature generation.

I would expect my signature to be still valid because it should "exclude" the entire 'Signature' and all of its childs (although I see the XMLDS spec does not say that but is intending it, isn't it???
Additionally, If I am 'excluding' a structure, I would expect to also exlcude the whitespaces in it.

Am I getting wrong something?

Tot ziens
Atlana


-- 
SEEBURGER AG, Edisonstrasse 1, D-75015 Bretten, Germany
Fon:+49(0)7252 96-1185 Fax:+49(0)7252 96-2400 <http://www.seeburger.de/>