SignedInfo not canonicalized when validating signature?

Question

Hi,
In my project, I sign a part of an XML document using an enveloped signature, send the document in a SOAP message, and then get the document POST:ed back to me in an HTML form. When implementing this, I have come across this strange behavior that I'd appreciate if someone would like to explain to me.
It seems as if the SignedInfo element in the document is not canonicalized according to its CanonicalizationMethod before the signature is validated. This makes the signature validation fail if the contents of the SignatureInfo is somehow reformatted after creating it, for instance if I use OutputKeys.Indent to pretty-print the document when serializing it using a javax.xml.transform.Transformer.
I can (I believe) verify this by calling SignedInfo.getCanonicalizedData when validating the signature. If I don't pretty-print the document when transforming it, I get the exepected result
<SignedInfo [ns declarations]>[SignedInfo contents]</SignedInfo>
on one row and the signature passes validation, but if I do pretty-print it, I just get
<SignedInfo [ns declarations]>
and consequently the signature validation fails.
This behavior does not seem to not be in accordance with the spec,
http://www.w3.org/TR/xmldsig-core/, chapter 3.2 Core Validation
Is this a bug or have I missed any of the finer points of XML signature validation?
Regards
/Karl

Answer 1

I'm having the same issue. Did you solve your problem?
mmarques
Edited by: mmarques on Dec 19, 2007 7:10 AM