File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
The moose likes Web Services Certification (SCDJWS/OCEJWSD) and the fly likes XML Signature and canonicalization Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Certification » Web Services Certification (SCDJWS/OCEJWSD)
Bookmark "XML Signature and canonicalization" Watch "XML Signature and canonicalization" New topic

XML Signature and canonicalization

Dan Drillich
Ranch Hand

Joined: Jul 09, 2001
Posts: 1183
Good Day,

It seems to me that canonicalization is a prerequisite for XML Signature. I just wonder if it is mandatory. After all, we can have integrity of the message even without canonicalization.

Any thoughts?


William Butler Yeats: All life is a preparation for something that probably will never happen. Unless you make it happen.
amit punekar
Ranch Hand

Joined: May 14, 2004
Posts: 544
In my opinion Canonicalization is necessary so that you compute Hash on the basic form of the data without any other characters like spaces.

Dan Drillich
Ranch Hand

Joined: Jul 09, 2001
Posts: 1183
Right, but Canonicalization is considered to be a resource intensive operation and if one wants only to guarantee the integrity of the a particular message, Canonicalization doesn't seem to be needed.

Ivan Krizsan
Ranch Hand

Joined: Oct 04, 2006
Posts: 2198
The question is slightly old, but I couldn't resist the prospects of a good discussion!

Assume the following trivial XML fragments:


With ns1 and ns2 both referring to the same namespace.

We can both tell that the first XML fragment is a valid version of the second XML fragment that has not been tampered with.
However, in order for a piece of software to be able to determine this, I feel we need to transform the XML fragments into some kind of normalized (i.e. canonical) form.
Having been "normalized", the program will then be able to determine if the XML fragments are equal or not.
Best wishes!

My free books and tutorials:
I agree. Here's the link:
subject: XML Signature and canonicalization
It's not a secret anymore!