How to digitally sign an XML document

Digitally signing an XML document ensures authenticity, integrity, and non-repudiation by binding a cryptographic signature to the content. 2. Use W3C-compliant methods like enveloped, enveloping, or detached signatures, with enveloped being common in SAML and SOAP. 3. Prepare a private key, X.509 certificate, and a supported library such as signxml for Python, Apache Santuario for Java, or .NET’s SignedXml. 4. In Python, use signxml to sign the XML with the private key and embed the signature, typically using the enveloped method. 5. Always validate the signature afterward to confirm data integrity and origin, ensuring canonicalization is applied to prevent formatting issues.

Digitally signing an XML document ensures its authenticity, integrity, and non-repudiation. This process binds a digital signature to the XML content so that any change to the data invalidates the signature. Here's how to do it properly.

Understand XML Signature Basics

An XML signature isn't just a signature attached to XML—it's a standardized way (defined by the W3C XML Signature specification) to sign parts of an XML document using cryptographic methods.

• Enveloped Signature: The signature is embedded within the XML document it signs.
• Enveloping Signature: The signed data is inside the signature element.
• Detached Signature: The signature is external to the document.

Most common use cases, like in SAML or SOAP, use enveloped signatures.

Prepare Your Environment

You'll need:

• A private key (typically in PKCS#8 or PEM format)
• A public key certificate (X.509)
• A library that supports XML Digital Signatures

Popular tools and libraries include:

• Java: Apache Santuario (via javax.xml.crypto)
• .NET: System.Security.Cryptography.Xml.SignedXml
• Python: lxml with signxml library
• Command-line: Use xmlsectool (from Internet2)

Sign Using Code (Example in Python)

If you're using Python, the signxml library makes this straightforward:

<font face="monospace">from signxml import XMLSigner
import xml.etree.ElementTree as ET
<h1>Load your XML</h1>
<p>with open("document.xml") as f:
xml_data = ET.fromstring(f.read())</p>
<h1>Create a signer with your key and cert</h1>
<p>signer = XMLSigner(method=signxml.methods.enveloped)
signed_xml = signer.sign(xml_data, key="private.key", cert="cert.pem")</p>
<h1>Save result</h1>
<p>with open("signed_document.xml", "wb") as f:
f.write(ET.tostring(signed_xml))
</p></font>

This applies an enveloped signature and embeds it in the original XML.

Validate the Signature

Always verify the signature after signing:

<font face="monospace">from signxml import XMLVerifier
<p>verified_data = XMLVerifier().verify(signed_xml, x509_cert="cert.pem").signed_xml
print("Signature is valid")
</p></font>

Validation confirms the document hasn’t been altered and was signed by the expected party.

Make sure to canonicalize the XML before hashing—this avoids issues from whitespace or attribute ordering. Most libraries handle this automatically when using proper XML Signature standards.

Basically, sign the right part of the document, use secure keys, and follow the XML Signature spec. Done correctly, it’s a robust way to secure XML data.

The above is the detailed content of How to digitally sign an XML document. For more information, please follow other related articles on the PHP Chinese website!