Are there any good books on XML DSig available, especially those that talk about the Apache DSig Java APIs? I'm re-engineering an existing application that used its own digital signatures, which gave it complete flexibility, and with XML DSigs we'll need a bit more rigor up front in terms of formats, optional fields, etc.
In particular, we're looking for detached signatures because we need to be able to add lots of signatures to a given data set, and that data set includes large elements like an attached file (Word, Excel, PDF, HTML, text, XML, JPEG, GIF, TIFF, MPEG, AU or whatever that can easily be multiple MBs in size) as well as being combined with various meta data related to the signature (actual timestamps, IP addresses, name of signer, email address, authentication information, etc.). Our signatures need to include simple "integrity only" signatures, legal electronic authorize/agree signature dsigs, approve signatures, initialing "sigs", review signatures, etc. A single transaction can be composed of many parts, including multiple independently signed documents (with all the varying types of signatures: review, approve, authorize/agree), multi-HTML form page "documents"). A transaction can have new documents added over time, so the final XML transaction document is really composed of multiple independently signed parts that are known to belong to the whole, but the "whole" can grow over time until its "fully executed" or "process completed." Thanks for any pointers. Again, we do this quite easily with our homegrown (yet openly published spec) digital signatures that simply add whatever data elements we need at the time without worrying about how to make these varying parts work in an XML format that best supports xml dsigs. David
