Functional explanation of changes in XML Signature 1.1

Algorithms Added

Add Elliptic Curve signature algorithms: ECDSA-SHA1 (OPTIONAL), ECDSA-SHA224 (OPTIONAL), ECDSA-SHA256 (REQUIRED), ECDSA-SHA384 (OPTIONAL), and ECDSA-SHA512 (OPTIONAL)
Generally extend SHA beyond SHA-1
- Add digest algorithms: SHA224 (OPTIONAL), SHA256 (REQUIRED), SHA384 (OPTIONAL), SHA512 (OPTIONAL)
- Add RSA signing algorithms: RSAwithSHA224 (OPTIONAL), RSAwithSHA256 (REQUIRED), RSAwithSHA384 (OPTIONAL),RSAwithSHA512 (OPTIONAL)
- Added HMAC-SHA224 (OPTIONAL)
Update canonicalization algorithms to reflect existing practice
- Add Exclusive XML Canonicalization 1.0 (omits comments) REQUIRED.
- Add Exclusive XML Canonicalization 1.0 (with Comments) RECOMMENDED.
Add XPath Filter 2.0 as RECOMMENDED transform algorithm. (alternative to URI fragment identifiers).

For all algorithms added, algorithm identifiers and information were added to the specification.

Discourage use of SHA-1 but allow it for compatibility
- SHA-1 use is DISCOURAGED (but support is still REQUIRED).
- Added text to SHA-1 to state that use is DISCOURAGED (but still REQUIRED).
- Added text to HMAC-SHA1 to state that use is DISCOURAGED
- Change so that DSAwithSHA1 is only REQUIRED as Signature algorithm for Signature verification, but is OPTIONAL for Signature generation. Previously it was REQUIRED for both.
- Added text to indicate that use of RSA-SHA1 and ECDSA-SHA1 is DISCOURAGED.
Enable alternatives to SHA-1
- Changed HMAC-SHA256 to REQUIRED
- Changed HMAC-SHA384, HMAC-SHA512 to RECOMMENDED (from OPTIONAL).
Discourage use of XPath transform by adding a note that implementation requirements for XPath transform may be downgraded to optional in future version of specification.
Added minimum output length for HMACOutputLength parameter in SignatureMethod

Clarify DSA family with respect to FIPS 186-3.
Clarify RSA SignatureValue computation.
Clarify inputs and outputs of algorithms, specifically Canonical XML 1.0 and Canonical XML 1.1 canonicalization, Base64, XPath filtering, and Enveloped Signature Transform, and XSLT Transform algorithms.
Add recommendation to use least expressive transform possible to achieve result.

REQUIRED support of KeyValue formats for DSA, RSA (REQUIRED now, no longer RECOMMENDED), and ECDSA
Add new KeyInfo child elements with corresponding URIs
- ECKeyValue, ECParameters
- DEREncodedKeyValue
Add sections on how to use additional KeyInfo child elements
- Describe use of XML Encryption EncryptedKey and DerivedKey Elements
- Add DEREncodedKeyValue - new representation for public keys
- Add KeyInfoReference - alternative to RetrievalMethod access to a KeyInfo element that does not require use of a Transform
Clarify for RetrievalMethod that a Transform is needed to obtain content of KeyInfo referenced by ID
Updated KeyInfoReference to SHOULD instead of RetrievalMethod to encourage use of new KeyInfoReference element instead of RetrievalMethod
Added profile of RFC 4050 with respect to ECDSA key formats.

Support revocation checking by adding dsig11:OCSPResponse to list of elements that may be included
Add dsig11:X509Digest to list of elements that may be included, to support reference via base64-encoded digest of a certificate
Add that the RECOMMENDED certificate encoding is BER or DER subset.
Deprecate and add note regarding use of X509IssuerSerial and possible issue with schema validation when large serial numbers are used.
Add note about the need to sign entire structure as a unit when using X509Data in explicitly trusted scenarios.

Clarify that C14N is needed as part of Reference validation since changes could occur in serialization after Signature generation.
Clarify canonicalization, removing Normalization Form C material.
Referenced the XML Signature Best Practices Note from the introduction.

Note possible concerns with digest algorithm resistance to collisions and strongly recommending use of SHA-256 in preference to SHA-1
Add new security consideration for implementations to limit information included in error responses for security algorithms.
Add security considerations regarding DSA key sizes and update considerations related to RSA key sizes.