title: What exactly does the enveloped signature transform?
body: <p>If I want to sign the next XML code with envoloped signature:</p>
  
  <pre><code>&lt;root&gt;
  &lt;element&gt;
  &lt;child&gt;text node&lt;/child&gt;
  &lt;/element&gt;
  &lt;/root&gt;
  </code></pre>
  
  <p>Then the Signature XML code takes place inside the signed XML code, in the way shown below:</p>
  
  <pre><code>&lt;root&gt;
  &lt;element&gt;
  &lt;child&gt;text node&lt;/child&gt;
  &lt;/element&gt;&lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;...&lt;/Signature&gt;
  &lt;/root&gt;
  
  Notice: no line break nor single character is added outside Signature element since that would invalidate the signature.
  </code></pre>
  
  <p>The XML enveloped signature code includes a &lt;Transform Algorithm&gt; which especifies a modification the code has to suffer, which strictly speaking is done whether in signature or verifying proccess. The &lt;Transform Algorithm&gt; is the next:</p>
  
  <pre><code>&lt;Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
  </code></pre>
  
  <p>In the W3C website (official documentation) the expression above is compared to the expression below. In both cases the same output have to be produced.</p>
  
  <pre><code>&lt;XPath xmlns:dsig="&amp;dsig;"&gt;
     count(ancestor-or-self::dsig:Signature |
     here()/ancestor::dsig:Signature[1]) &gt;
     count(ancestor-or-self::dsig:Signature)&lt;/XPath&gt;
  </code></pre>
  
  <p>Reference: <a href="http://www.w3.org/TR/xmldsig-core/#sec-EnvelopedSignature" rel="nofollow">http://www.w3.org/TR/xmldsig-core/#sec-EnvelopedSignature</a></p>
  
  <p><strong>Before the Transform:</strong></p>
  
  <p>Case 1 (to sign):</p>
  
  <pre><code>&lt;root&gt;
  &lt;element&gt;
  &lt;child&gt;text node&lt;/child&gt;
  &lt;/element&gt;
  &lt;/root&gt;
  </code></pre>
  
  <p>Case 2 (signed):</p>
  
  <pre><code>&lt;root&gt;
  &lt;element&gt;
  &lt;child&gt;text node&lt;/child&gt;
  &lt;/element&gt;&lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;...&lt;/Signature&gt;
  &lt;/root&gt;
  </code></pre>
  
  <p><strong>After the Transform:</strong></p>
  
  <pre><code>&lt;root&gt;
  &lt;element&gt;
  &lt;child&gt;text node&lt;/child&gt;
  &lt;/element&gt;
  &lt;/root&gt;
  </code></pre>
  
  <p>In both cases the same output is produced, which allow us to verify that the signed data is authentic.</p>
  
  <p>I am still having issue with a server saying my signatures are invalid, can someone please confirm if I am doing the Transform correctly?</p>
  
  <p>Thanks a lot</p>
  
  <p>Regards</p>