This document is the interop report for new features introduced in XML Signature 1.1. It includes the test cases and test results for these new features. It does not replicate interop testing performed for features retained from XML Signature 1.0.
This document summarizes interop tests and the test results for new features introduced in XML Signature 1.1 [[XMLDSIG-CORE1]]. Changes to XML Signature introduced in XML Signature 1.1 are summarized in a detailed change explanation document [[XMLDSIG-CORE1-CHGS]].
Tests that are marked 'Y' are completed, 'U' means 'untested' and should not be taken to make a statement about the implementation (as testing may simply not have been performed for interop due to timing or other reasons).
ECDSA-SHA1
(OPTIONAL), ECDSA-SHA224 (OPTIONAL),
ECDSA-SHA256 (REQUIRED),
ECDSA-SHA384 (OPTIONAL), and ECDSA-SHA512
(OPTIONAL)ECKeyValue
(includes ECParameters) Various combinations of the following
Microsoft's test vectors - 48 files
Oracle's test vectors - 18 files
See test file directory.
| Signature Algorithm | Digest | Canonicalization | ECKeyValue | Microsoft | Oracle |
|---|---|---|---|---|---|
| ECDSA (P256/P384/P521] with | SHA-1 | Excl C14N | ECKeyValue | Y | Y |
| ECDSA (P256/P384/P521] with | SHA-256 | Excl C14N | ECKeyValue | Y | Y |
| ECDSA (P256/P384/P521] with | SHA-384 | Excl C14N | ECKeyValue | Y | Y |
| ECDSA (P256/P384/P521] with | SHA-512 | Excl C14N | ECKeyValue | Y | Y |
The following are the SHA-224 tests:
| Signature Algorithm | Digest | Oracle | Apache Santuario (C++) |
|---|---|---|---|
| ECDSA (P256/P384/P521] with | SHA-224 | Y | Y |
SHA224 (OPTIONAL), SHA256
(REQUIRED), SHA384 (OPTIONAL),
SHA512 (OPTIONAL)RSAwithSHA224
(OPTIONAL), RSAwithSHA256 (REQUIRED),
RSAwithSHA384 (OPTIONAL),RSAwithSHA512
(OPTIONAL)HMAC-SHA224 (OPTIONAL)HMAC-SHA256 to REQUIREDHMAC-SHA384, HMAC-SHA512 to
RECOMMENDED (from
OPTIONAL).SHA-1 but allow it for compatibility
SHA-1 use is DISCOURAGED (but support is still REQUIRED).SHA-1 to state that use is DISCOURAGED (but still REQUIRED).HMAC-SHA1 to state that use is DISCOURAGEDDSAwithSHA1 is only REQUIRED as
Signature algorithm
for Signature verification, but is OPTIONAL for Signature
generation. Previously it was REQUIRED for both. RSA-SHA1
and ECDSA-SHA1 is
DISCOURAGED.Various combinations of the following
Sun's test vectors - 18 files
Oracle's test vectors - 9 files (same as sun's, C14n 1.0 only)
Microsoft's test vectors - 14 files
HMAC key
| Digest | Signature | Canonicalization | Sun | Oracle |
|---|---|---|---|---|
| SHA-1 | RSA-SHA256 | C14N1.0 | Y | Y |
| SHA-1 | RSA-SHA384 | C14N1.0 | Y | Y |
| SHA-1 | RSA-SHA512 | C14N1.0 | Y | Y |
| SHA-1 | HMAC-SHA256 | C14N1.0 | Y | Y |
| SHA-1 | HMAC-SHA384 | C14N1.0 | Y | Y |
| SHA-1 | HMAC-SHA512 | C14N1.0 | Y | Y |
| SHA-384 | RSA-SHA256 | C14N1.0 | Y | Y |
| SHA-512 | RSA-SHA256 | C14N1.0 | Y | Y |
| Digest | Signature | Oracle | Apache Santuario (C++) |
|---|---|---|---|
| SHA-224 | RSA-SHA224 | Y | Y |
| SHA-224 | RSA-SHA256 | Y | Y |
| SHA-224 | HMAC-SHA224 | Y | Y |
X509Data Additionsdsig11:X509Digest to list of elements that may
be included, to support reference via base64-encoded digest of a
certificate
Note: X509Digest was added to correct issues
with X509IssuerSerial.
X509Data Test CasesX509Data Test Results| Item | OpenSAML (Shibboleth) | Oracle |
|---|---|---|
| X509Digest | Y | Y |
KeyInfo AdditionsDEREncodedKeyValue KeyInfo child elementKeyInfo child elements
EncryptedKey
and DerivedKey ElementsDEREncodedKeyValue - new representation for
public keysKeyInfoReference - alternative to RetrievalMethod access to a
KeyInfo element that does not require use of a TransformKeyInfo Test CasesDEREncodedKeyValue with ECKey:
https://www.w3.org/2008/xmlsec/Group/interop/xmldsig11/oracle/signature-enveloping-derencoded-ec.xml
DEREncodedKeyValue with RSAKey:
https://www.w3.org/2008/xmlsec/Group/interop/xmldsig11/oracle/signature-enveloping-derencoded-rsa.xml
KeyInfoReference:
https://www.w3.org/2008/xmlsec/Group/interop/xmldsig11/oracle/signature-enveloping-keyinforeference-rsa.xml
KeyInfo Test Results| Item | Apache Santuario (C++) | OpenSAML (Shibboleth) | Oracle |
|---|---|---|---|
DEREncodedKeyValue (both EC and RSA) | Y | U | Y |
KeyInfoReference | U | Y | Y |
Note: Same author for both Apache Santuario (C++) and OpenSAML
(Shibboleth) implementations. In OpenSaml reproduced the X509Digest
material by consuming the same keypair and successfully processing the
KeyInfoReference after copying it into a SAML document.
HMACOutputLength verificationHMACOutputLength parameter in
SignatureMethod.
Verify that signature is deemed invalid
if HMacOutputLength truncation length is below the
larger of (a) half the underlying hash algorithm's output length,
and (b) 80 bits. Test that error generated for SHA-256 with
truncation length is less than 128, e.g. 100 bits [[RFC4868]].
HMACOutputLength Test Cases
The following are test vectors for HMACOutputLength verification:
The first one is truncated to 40 bytes, so it should be rejected. The second one is not truncated at all, so it should be accepted.
HMACOutputLength Test ResultsHMACOutputLength | Oracle | Apache Santuario (C++) |
|---|---|---|
| Truncated 40 (invalid) | Y | Y |
| Truncated 160 (valid) | Y | Y |
The following algorithms were added or changed in XML Signature 1.1 but were not included in this round of interop testing as they have been previously tested during the development of the corresponding W3C Recommendations: