Aleksey Sanin wrote:
> How do you verify signature? Do you use xmlsec application or your code?
Sorry about that, I'm using the xmlsec application. That's what I meant
by "xmlsec tool".
I'll attach the actual xml. To verify, I run:
xmlsec verify <file>
-John
--
http:// i . /
<?xml version="1.0" encoding="UTF-8"?>
<Envelope xmlns="urn:envelope">
<Data>
Hello, World!
</Data>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#";>
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
<Reference URI="">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>VweSIbNEl2P2r6lm+OL7hVJTwt8=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>HfKV8YVy6s+YIEejVAXMW1wUlq8KXQH+XNMQmwDOkdzMMnIvgTOtUw==</SignatureValue>
<KeyInfo>
<RetrievalMethod URI="#foo"/>
</KeyInfo>
</Signature>
<KeyInfo Id="foo" xmlns="http://www.w3.org/2000/09/xmldsig#";>
<KeyValue>
<DSAKeyValue>
<P>
iqx200qTk5ojXcvGRmTXtwLmBwDrmWoBfl0L1VzxQm0BDjmnVgoCIiyeeYQH7YDB
iuP7f2AcJrocqaBa4pi+hG1pu/WfAyc2sc9dPavAqDo99ywL58dhE3blIL/bXhy7
MH4NzXY7196xTCuZyMBnZQ3qxUReghREd22m2YmFe60=
</P>
<Q>
nAIxeeJw9cjPjjD5NPT4X4I1eqU=
</Q>
<G>
Wai06HIyzWrDJzaMtPeYbi3DXlIf0N9eBgEcDDvK77ikG8+9A9iw6ymStZJdummy
MpBEKh7rSQ9GfaGvrBUyUlS34qaH7dvMfTHPWV9y1xaSysjuUT7U0dOxeBQw4uDF
sQXwcJS+UT/twnWlYBf1L5OdNy4mq0wib6pfevWsLEo=
</G>
<Y>
Oux1jjrB5ZYxIk1HHCBw5razG03KNhsHPDSU7ibHjWz+PonMTH6Tbcs32mCMaaOG
k1YKuPpTwemHhr0JbR2DbyLJzCBdLUe9Czr2UF70euSr+SHPvSluqMByRmS3mNKL
tUaYERHYl8dqzOEHTfD1D0QY2aCzAXrpYt56UEwMCoM=
</Y>
</DSAKeyValue>
</KeyValue>
</KeyInfo>
</Envelope>
