C
chenzhongshan
Unregistered / Unconfirmed
GUEST, unregistred user!
Signature Creation Steps
1.For each data to be signed
·Determine if the signature will be enveloped, enveloping or detached.
·Apply Transforms to the data item
·Calculate the DigestValue from the Transform element
·Create a Reference clause including Transforms, DigestMethod and DigestValue clauses
2.Create SignedInfo clause with SignatureMethod, CanonicalizationMethod and Reference clause.
3.Canonicalize SignedInfo clause and compute the SignatureValue.
4.Construct Signature clause including SignedInfo and SignatureValue [4]
On the Recipient’s End
Similar to Figure 2, once the information is received by the intended recipient, it must be validated. Validation on the recipient side consists of two steps:
1.1.Reference Validation
Validation of each digest contained in each Reference element. This checks the integrity of the signed data.
1.For each Reference element:
a) Obtain the signed data object
b) Digest the resulting data object with the algorithm specified in the DigestMethod element
c) Compare the resulting digest against the value stored into the DigestValue element
d) If the two valuesdo
not match then
the validation fails, else
e) Execute Signature Validation [1]
2.Signature Validation
Validation of the SignedInfo element. This checks the authen
ticity of the signature.
1. Canonicalize the Signed element using the canonical algorithm specified in the CanonicalizationMethod element.
2. Create the digest of the canonical form of SignedInfo element, using the digest algorithm specified in the SignatureMethod element.
3. Decrypt the data contained into the SignatureValue element with the keys obtained in Step 1 and the encryption algorithm specified in the SignatureMethod element
4. Compare the digest value obtained in Step 3 against the decrypted data obtained in Step 4
5. If the two valuedo
not match then
the signature validation fails, otherwise
6. The signature validation successfully terminates. [1]
1.For each data to be signed
·Determine if the signature will be enveloped, enveloping or detached.
·Apply Transforms to the data item
·Calculate the DigestValue from the Transform element
·Create a Reference clause including Transforms, DigestMethod and DigestValue clauses
2.Create SignedInfo clause with SignatureMethod, CanonicalizationMethod and Reference clause.
3.Canonicalize SignedInfo clause and compute the SignatureValue.
4.Construct Signature clause including SignedInfo and SignatureValue [4]
On the Recipient’s End
Similar to Figure 2, once the information is received by the intended recipient, it must be validated. Validation on the recipient side consists of two steps:
1.1.Reference Validation
Validation of each digest contained in each Reference element. This checks the integrity of the signed data.
1.For each Reference element:
a) Obtain the signed data object
b) Digest the resulting data object with the algorithm specified in the DigestMethod element
c) Compare the resulting digest against the value stored into the DigestValue element
d) If the two valuesdo
not match then
the validation fails, else
e) Execute Signature Validation [1]
2.Signature Validation
Validation of the SignedInfo element. This checks the authen
ticity of the signature.
1. Canonicalize the Signed element using the canonical algorithm specified in the CanonicalizationMethod element.
2. Create the digest of the canonical form of SignedInfo element, using the digest algorithm specified in the SignatureMethod element.
3. Decrypt the data contained into the SignatureValue element with the keys obtained in Step 1 and the encryption algorithm specified in the SignatureMethod element
4. Compare the digest value obtained in Step 3 against the decrypted data obtained in Step 4
5. If the two valuedo
not match then
the signature validation fails, otherwise
6. The signature validation successfully terminates. [1]