[xmlsec] Signing with root element not having namespace
aleksey at aleksey.com
Thu Jun 4 08:09:49 PDT 2020
In xmndsig-core-schema.xsd, there is targetNamespace defined:
Which places ALL entities (types, elements, ...) from this schema
into this namespace (including Signature node itself).
In XYZBlock.xsd, the same Signature element is redefined for no
obvious reasons as
<xs:element name="Signature" type="ds:SignatureType"/>
This should be replaced with something like this to reference the
Signature element defined in xmldsig spec:
As it stands right now, this is not an xmldsig compatible construct.
Hope this helps,
On 6/4/20 3:57 AM, Kiss Ádám wrote:
> Thank you for your answer!
> Unfortunately the standard is not public, but obfuscated version should
> be okay for investigation. I've attached the XSDs the standard specify.
> The XML I sent you earlier is just our interpretation, can be changed.
> Do you have any idea we can go on?
> Bests, Adam
> *Feladó:* Aleksey Sanin <aleksey at aleksey.com>
> *Elküldve:* 2020. június 3. 17:39
> *Címzett:* Kiss Ádám; xmlsec at aleksey.com
> *Tárgy:* Re: [xmlsec] Signing with root element not having namespace
> Indeed in your XML file the Signature node doesn't have the correct
> <Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> Is this standard publically available somewhere? This doesn't look
> right to me.
> On 6/3/20 7:50 AM, Kiss Ádám wrote:
>> I've been using your lib for a long time with many success!
>> Now I got a task which I cannot handle with my skills. I've attached a
>> simplified version of the XML.
>> The main problem is that an industry standard determines the whole
>> structure of the XML in this application including the namespaces. When
>> I tried to sign it with the standard method in the doc I got the error:
>> 'node not found'. It turned out xmlsecGetNodeNSHref sees the <Signature>
>> block with (null) namepspace, which doesn't fit xmlsec's requirement.
>> Changing xmlSecFindNode to ignore the (null) namespace helped for a
>> short time, but some function calls later a similar error was found in
>> xmlSecFindParent. After getting over again C14N failed. I am not sure if
>> that (null) is the problem during the canonization.
>> I cannot see that deep into the code. Could you help me out?
>> xmlsec mailing list
>> xmlsec at aleksey.com
> xmlsec mailing list
> xmlsec at aleksey.com
More information about the xmlsec