[SignedXml].CheckSignature() do not pass with

Question

Why [SignedXml].CheckSignature() do not pass if canonicalization method is inclusive REC-xml-c14n-20010315? The same code is working if document is canonicalizated with excl. method I'm using .NET 8

Deepika Sawant · Answer

Inclusive canonicalization ( REC-xml-c14n-20010315 ) can cause SignedXml.CheckSignature() to fail in .NET 8 due to namespace handling differences, especially when default or unused namespaces are present. Exclusive canonicalization avoids these issues by omitting unused namespaces. Key Differences Between Inclusive and Exclusive Canonicalization Inclusive Canonicalization ( REC-xml-c14n-20010315 ) : Includes all namespace declarations in the canonicalized output, even if they’re not used in the signed node. This can lead to mismatches between the digest value and the actual canonicalized content during verification. Exclusive Canonicalization ( xml-exc-c14n# ) : Includes only the namespaces that are actually used in the signed node. This results in a cleaner digest and fewer verification issues. Why It Fails in .NET 8 .NET’s SignedXml implementation is sensitive to namespace context and whitespace . If the inclusive canonicalization includes extra namespaces or whitespace that weren’t present during signing, the computed digest during verification will differ from the original. This mismatch causes CheckSignature() to return false . How to Fix or Work Around It Prefer Exclusive Canonicalization : Use http://www.w3.org/2001/10/xml-exc-c14n# in your and elements. This is especially important when signing nested elements or working with SOAP messages. Ensure PreserveWhitespace = true : Before loading the XML: XmlDocument doc = new XmlDocument(); doc.PreserveWhitespace = true; doc.Load(xmlStream); Avoid unnecessary namespaces : Clean up unused or default namespaces in the signed portion of the XML. Use XmlDsigExcC14NTransform explicitly : When creating the signature: var transform = new XmlDsigExcC14NTransform(); reference.AddTransform(transform);

[SignedXml].CheckSignature() do not pass with

Why [SignedXml].CheckSignature() do not pass if canonicalization method is inclusive REC-xml-c14n-20010315?

Insert Link

Embed YouTube Video

Table Options

Insert Image

Answers (1)