Signatures

• I want to publicize my address list
• But first I have to prove its authenticity: "sign" it
• This is where XML Signature comes in:
  • add a non-forgeable signature to an XML file (or part of it)
  • the signature can be a separate XML file ("detached"), or ...
  • the signature can be "enveloped" into the content (eg, as metadata)
• Main signature processing steps:
  • create a "digest" of the content
    • non-invertible function to yield a unique number
  • encrypt the digest and store the encryption
  • add information about encryption keys (optional)
  • package everything into an XML file