I'm really new with xml signature and I was assigned to a project on which I have to sign and on other side verify a detached xml signature of a "XML based protocol message" (it is 3dsecure protocol using XML messagges).
Requirements for signature are: Signature One instance of KeyInfo; zero instances of Object CanonicalizationMethod Element is EMPTY with Algorithm attribute present SignatureMethod Element is EMPTY with Algorithm attribute present Transforms Not present DigestMethod Element is EMPTY with Algorithm attribute present KeyInfo One instance of X509Data X509Data One instance of X509Certificate for each certificate to be included and Algorithm Type Identifier: Canonicalization http://www.w3.org/TR/2001/REC-xml-c14n-20010315 Digest http://www.w3.org/2000/09/xmldsig#sha1 Encoding http://www.w3.org/2000/09/xmldsig#base64 MAC http://www.w3.org/2000/09/xmldsig#hmac-sha1 Signature http://www.w3.org/2000/09/xmldsig#rsa-sha1 Transform none Does anybody have an example of doing detached signatures ? I had a look to org.apache.xml.security.samples.signature.CreateSignature.java and org.apache.xml.security.samples.signature.VerifySignature.java, but they use "enveloped signature". I know it should be quite similar, but I'm too new with this technology and I don't perfectly understand differences. So is there someone helping me sending two sample java code (sign + verify), similar to those one , using Algorithms I need ? Thanks a lot, Enrico
