title: URI in XML-DSIG and digest calculation
body: <p>I am analyzing an XML-DSIG file in order to know how to write my piece of software code that generates XML-DSIGnatures. I am having this trouble and desperately need help...
  I am trying to understand this bit from signatures0.xml (quoted after this bit):</p>
  
  <pre><code>&lt;Reference Type="http://uri.etsi.org/01903#SignedProperties" URI="#SignedPropertiesElem_0" xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;Transforms xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
          &lt;/Transforms&gt;
          &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
          &lt;DigestValue&gt;kOlNXyBs6oSP9hbh+4niZMNQ9OsOCzYhkSYYG4YdHQU=&lt;/DigestValue&gt;
      &lt;/Reference&gt;
  </code></pre>
  
  <p>signatures0.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;document-signatures xmlns="urn:oasis:names:tc:opendocument:xmlns:digitalsignature:1.0"&gt;
  &lt;Signature Id="SignatureElem_0" xmlns="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
  &lt;SignedInfo&gt;
  &lt;CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
  &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
          &lt;Reference URI="metadata/signableMetadata0.xml" xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;Transforms xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116"&gt;
                      &lt;XPath&gt;ancestor-or-self::*[@ID='signature_0']&lt;/XPath&gt;
                  &lt;/Transform&gt;
                  &lt;Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
              &lt;DigestValue&gt;XIrOvoOM33rWvV5Fdckax/bNLOpR9RNIonkVQ22fczM=&lt;/DigestValue&gt;
          &lt;/Reference&gt;
          &lt;Reference URI="1.docx" xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
              &lt;DigestValue&gt;LtTwOA0L3mL4mswjGL3JwkumufovE/A75M4MGSUm6PQ=&lt;/DigestValue&gt;
          &lt;/Reference&gt;
          &lt;Reference Type="http://uri.etsi.org/01903#SignedProperties" URI="#SignedPropertiesElem_0" xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;Transforms xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
                  &lt;Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
              &lt;DigestValue&gt;kOlNXyBs6oSP9hbh+4niZMNQ9OsOCzYhkSYYG4YdHQU=&lt;/DigestValue&gt;
          &lt;/Reference&gt;
  &lt;/SignedInfo&gt;
  &lt;SignatureValue&gt;
  EPuWjb6IeuYg32FT1tInmO7FPL1ISuluFvrPqzHdHyJ0ymgMFitaWPJQk0MV6ckgmvFwif6zpg5C
  XLVJl4U+e/+AmS1AkwMf2TmnuIONuB8oLeYcDUCr+0xxlwgKSZoopzapD7ylZxIwCPTMr6BT3lx9
  8EFHHVskC4wVihR0JsJWBl2YzGnBevCWpknGofa8t8vOHpTA2y9VSAu5ETXnKYF5Ms04kTy5NQ7G
  kHcslw+HSAuaJolvfUd4EeqAXVFz9V7sE+akQ20fciw9QQH8gttF8bIous8dsv3/6Zmtclvbk17Q
  79pI+2o7JKhZIh9ct0PHTMpU5KV6GEXxIrCb4g==
  &lt;/SignatureValue&gt;
  &lt;KeyInfo&gt;
  &lt;X509Data&gt;
  &lt;X509Certificate&gt;
  MIIKVTCCCT2gAwIBAgIOQNXCrd79knQAAAALm2IwDQYJKoZIhvcNAQEFBQAwgb0xCzAJBgNVBAYT
  AkxUMUAwPgYDVQQKEzdHeXZlbnRvanUgcmVnaXN0cm8gdGFybnliYSBwcmllIExSIFZSTSAtIGku
  ay4gMTg4NzU2NzY3MTEwLwYDVQQLEyhOYWNpb25hbGluaXMgc2VydGlmaWthdmltbyBjZW50cmFz
  IChOU0MpMTkwNwYDVQQDEzBOYWNpb25hbGluaXMgc2VydGlmaWthdmltbyBjZW50cmFzIChJc3N1
  aW5nQ0EtQikwHhcNMTQwMjA0MTM1NTUwWhcNMTcwMjAzMTM1NTUwWjBjMQswCQYDVQQGEwJMVDEZ
  MBcGA1UEAwwQU0lHSVRBIFBVVFJJRU7EljESMBAGA1UEBAwJUFVUUklFTsSWMQ8wDQYDVQQqEwZT
  SUdJVEExFDASBgNVBAUTCzQ4MjA5MjkwOTI5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
  AQEAlsxbvBk8SKnC8MX9mJ01dsnVhdsaX/8RiSq9nxosZ5B/gtBEOPr+3WIZ6F5+RK9IN59ONip7
  rOXVJLXZI5GbbCFtGYMy24KfBuoTvnqvLCKw9p2A5o3WVeM2LuEnT4X09UPZPcNrPyPs+z2IafTE
  7eltUfP4EcdFqh4nCnGoj6iFiUiHHAB2VjF+b8R8e8y7+KenanhR7p8Fo1waBfY4h9dAm0ZcCxDQ
  DEcQzsXY06yi0Im/G0496hOonOqi+HHX1tgWENIzsyIgMH0h+aI6dN26JxUkQ6z0Q47gvTcAs1lC
  Pc/6lHm9nM/6nZhn9URbxg6vxFgr5m5yf9gfXqcvYQIDAQABo4IGqjCCBqYwDgYDVR0PAQH/BAQD
  AgbAMB0GA1UdDgQWBBRTpqDcAOtayHSkdGcl+OUu+wYPMjBLBgNVHQkERDBCMA8GCCsGAQUFBwkD
  MQMTAUYwHQYIKwYBBQUHCQExERgPMTk4MjA5MjkxMjAwMDBaMBAGCCsGAQUFBwkEMQQTAkxUMB8G
  A1UdIwQYMBaAFHOCCdqDj7IH/YtgeHa+2t6EqsudMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9u
  c2MudnJtLmx0L2NkcC9Jc3N1aW5nQ0EtQi5jcmwwdwYIKwYBBQUHAQEEazBpMDQGCCsGAQUFBzAB
  hihodHRwOi8vbnNjLnZybS5sdC9PQ1NQL29jc3ByZXNwb25kZXIubnNjMDEGCCsGAQUFBzAChiVo
  dHRwOi8vbnNjLnZybS5sdC9haWEvSXNzdWluZ0NBLUIuY3J0MDwGCSsGAQQBgjcVBwQvMC0GJSsG
  AQQBgjcVCIHOw3SEvLhBg8GdP8SQT5vla4EigZL6KIPyqCsCAWQCAQQwFQYDVR0lBA4wDAYKKwYB
  BAGCNwoDDDCCBLwGA1UdIASCBLMwggSvMIIEqwYLKwYBBAGB+SgBAQEwggSaMIIEbAYIKwYBBQUH
  AgIwggReHoIEWgBUAGgAaQBzACAAcwB0AGEAdABlAG0AZQBuAHQAIABpAHMAIABhACAAcwB0AGEA
  dABlAG0AZQBuAHQAIABiAHkAIAB0AGgAZQAgAGkAcwBzAHUAZQByACAAdABoAGEAdAAgAHQAaABp
  AHMAIABjAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABpAHMAIABpAHMAcwB1AGUAZAAgAGEAcwAgAGEA
  IABRAHUAYQBsAGkAZgBpAGUAZAAgAGMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGEAYwBjAG8AcgBk
  AGkAbgBnACAAQQBuAG4AZQB4ACAASQAgAGEAbgBkACAASQBJACAAbwBmACAAdABoAGUAIABEAGkA
  cgBlAGMAdABpAHYAZQAgADEAOQA5ADkALwA5ADMALwBFAEMAIABvAGYAIAB0AGgAZQAgAEUAdQBy
  AG8AcABlAGEAbgAgAFAAYQByAGwAaQBhAG0AZQBuAHQAIABhAG4AZAAgAG8AZgAgAHQAaABlACAA
  QwBvAHUAbgBjAGkAbAAgAG8AZgAgADEAMwAgAEQAZQBjAGUAbQBiAGUAcgAgADEAOQA5ADkAIABv
  AG4AIABhACAAQwBvAG0AbQB1AG4AaQB0AHkAIABmAHIAYQBtAGUAdwBvAHIAawAgAGYAbwByACAA
  ZQBsAGUAYwB0AHIAbwBuAGkAYwAgAHMAaQBnAG4AYQB0AHUAcgBlAHMALAAgAGEAcwAgAGkAbQBw
  AGwAZQBtAGUAbgB0AGUAZAAgAGkAbgAgAHQAaABlACAAbABhAHcAIABvAGYAIAB0AGgAZQAgAGMA
  bwB1AG4AdAByAHkAIABzAHAAZQBjAGkAZgBpAGUAZAAgAGkAbgAgAHQAaABlACAAaQBzAHMAdQBl
  AHIAIABmAGkAZQBsAGQAIABvAGYAIAB0AGgAaQBzACAAYwBlAHIAdABpAGYAaQBjAGEAdABlAC4A
  IAFgAGkAcwAgAHMAZQByAHQAaQBmAGkAawBhAHQAYQBzACAAeQByAGEAIABrAHYAYQBsAGkAZgBp
  AGsAdQBvAHQAYQBzACAAcwBlAHIAdABpAGYAaQBrAGEAdABhAHMAIABwAGEAZwBhAGwAIABFAFMA
  IABkAGkAcgBlAGsAdAB5AHYAbwBzACAAMQA5ADkAOQAvADkAMwAvAEUAQwAgAGQBFwBsACAAQgBl
  AG4AZAByAGkAagBvAHMAIABlAGwAZQBrAHQAcgBvAG4AaQBuAGkAbwAgAHAAYQByAGEBYQBvACAA
  cABhAGcAcgBpAG4AZABpAG4AaQFzACAAbgB1AG8AcwB0AGEAdAFzACAASQAgAGkAcgAgAEkASQAg
  AHAAcgBpAGUAZAB1AHMAIABpAHIAIABMAGkAZQB0AHUAdgBvAHMAIABlAGwAZQBrAHQAcgBvAG4A
  aQBuAGkAbwAgAHAAYQByAGEBYQBvACABLwBzAHQAYQB0AHkAbQEFAC4wKAYIKwYBBQUHAgEWHGh0
  dHA6Ly9uc2MudnJtLmx0L3JlcG9zaXRvcnkwHQYJKwYBBAGCNxUKBBAwDjAMBgorBgEEAYI3CgMM
  MCIGCCsGAQUFBwEDBBYwFDAIBgYEAI5GAQEwCAYGBACORgEEMA0GCSqGSIb3DQEBBQUAA4IBAQAf
  PXZj6QagEgswUy+wit1MdCPMbKnF5LYszPtLG/PYbtuqXstBZljRR1tZVo8DRzoVRKwM7gpNNnWF
  UEtZoaafJ4uWmWWZLNSVAyaZUAJ67s2rkDPTtNtb7W9QCZJNIU2klegoY3JvDqAQzheE+Mj9HXnh
  0h21Qb8MWq4lHaL99/Vk9OXSlR9WYQfbEB5zbI5kp6nVePM2cf9uOZbhZRLdDAKbL/NrSGca3S40
  WZevQ1m9sdMgmobSTyuqniDXYIa7sO+QOzbMPIFuTn/izO13IK63uUBFnTImW+99PAyDx3s4Y03t
  EWpXA25hWn/NXH5xWC7ohKKeXzVUhnMN4WxT
  &lt;/X509Certificate&gt;
  &lt;/X509Data&gt;
  &lt;/KeyInfo&gt;
  &lt;Object&gt;
          &lt;QualifyingProperties Target="#SignatureElem_0" xmlns="http://uri.etsi.org/01903/v1.3.2#"&gt;
              &lt;SignedProperties Id="SignedPropertiesElem_0"&gt;
                  &lt;SignedSignatureProperties&gt;
                      &lt;SigningTime&gt;2014-08-21T06:09:55Z&lt;/SigningTime&gt;
                      &lt;SigningCertificate&gt;
                          &lt;Cert&gt;
                              &lt;CertDigest&gt;
                                  &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" xmlns="http://www.w3.org/2000/09/xmldsig#"/&gt;
                                  &lt;DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;JQ0kZvd0mtXQPA/RTuYV9iuc346tznvN9MoAd/0jNyM=&lt;/DigestValue&gt;
                              &lt;/CertDigest&gt;
                              &lt;IssuerSerial&gt;
                                  &lt;X509IssuerName xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;CN=Nacionalinis sertifikavimo centras (IssuingCA-B),OU=Nacionalinis sertifikavimo centras (NSC),O=Gyventoju registro tarnyba prie LR VRM - i.k. 188756767,C=LT&lt;/X509IssuerName&gt;
                                  &lt;X509SerialNumber xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;1315010063538360283821765366094690&lt;/X509SerialNumber&gt;
                              &lt;/IssuerSerial&gt;
                          &lt;/Cert&gt;
                      &lt;/SigningCertificate&gt;
                      &lt;SignaturePolicyIdentifier&gt;
                          &lt;SignaturePolicyImplied/&gt;
                      &lt;/SignaturePolicyIdentifier&gt;
                  &lt;/SignedSignatureProperties&gt;
              &lt;/SignedProperties&gt;
          &lt;/QualifyingProperties&gt;
      &lt;/Object&gt;
  &lt;/Signature&gt;&lt;/document-signatures&gt;
  </code></pre>
  
  <p>From what I understand, the first quoted bit refers to a <em>SignedPropertiesElem_0</em> element in the same file. I am trying to determine exactly what it refers to - what piece of code exactly should be selected and used later on for canonicalization and then calculating a digest value. Is it this:</p>
  
  <pre><code>&lt;SignedProperties Id="SignedPropertiesElem_0"&gt;
                  &lt;SignedSignatureProperties&gt;
                      &lt;SigningTime&gt;2014-08-21T06:09:55Z&lt;/SigningTime&gt;
                      &lt;SigningCertificate&gt;
                          &lt;Cert&gt;
                              &lt;CertDigest&gt;
                                  &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" xmlns="http://www.w3.org/2000/09/xmldsig#"/&gt;
                                  &lt;DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;JQ0kZvd0mtXQPA/RTuYV9iuc346tznvN9MoAd/0jNyM=&lt;/DigestValue&gt;
                              &lt;/CertDigest&gt;
                              &lt;IssuerSerial&gt;
                                  &lt;X509IssuerName xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;CN=Nacionalinis sertifikavimo centras (IssuingCA-B),OU=Nacionalinis sertifikavimo centras (NSC),O=Gyventoju registro tarnyba prie LR VRM - i.k. 188756767,C=LT&lt;/X509IssuerName&gt;
                                  &lt;X509SerialNumber xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;1315010063538360283821765366094690&lt;/X509SerialNumber&gt;
                              &lt;/IssuerSerial&gt;
                          &lt;/Cert&gt;
                      &lt;/SigningCertificate&gt;
                      &lt;SignaturePolicyIdentifier&gt;
                          &lt;SignaturePolicyImplied/&gt;
                      &lt;/SignaturePolicyIdentifier&gt;
                  &lt;/SignedSignatureProperties&gt;
              &lt;/SignedProperties&gt;
  </code></pre>
  
  <p>Or this:</p>
  
  <pre><code>&lt;SignedSignatureProperties&gt;
                      &lt;SigningTime&gt;2014-08-21T06:09:55Z&lt;/SigningTime&gt;
                      &lt;SigningCertificate&gt;
                          &lt;Cert&gt;
                              &lt;CertDigest&gt;
                                  &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" xmlns="http://www.w3.org/2000/09/xmldsig#"/&gt;
                                  &lt;DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;JQ0kZvd0mtXQPA/RTuYV9iuc346tznvN9MoAd/0jNyM=&lt;/DigestValue&gt;
                              &lt;/CertDigest&gt;
                              &lt;IssuerSerial&gt;
                                  &lt;X509IssuerName xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;CN=Nacionalinis sertifikavimo centras (IssuingCA-B),OU=Nacionalinis sertifikavimo centras (NSC),O=Gyventoju registro tarnyba prie LR VRM - i.k. 188756767,C=LT&lt;/X509IssuerName&gt;
                                  &lt;X509SerialNumber xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;1315010063538360283821765366094690&lt;/X509SerialNumber&gt;
                              &lt;/IssuerSerial&gt;
                          &lt;/Cert&gt;
                      &lt;/SigningCertificate&gt;
                      &lt;SignaturePolicyIdentifier&gt;
                          &lt;SignaturePolicyImplied/&gt;
                      &lt;/SignaturePolicyIdentifier&gt;
                  &lt;/SignedSignatureProperties&gt;
  </code></pre>
  
  <p>Or this:</p>
  
  <pre><code>&lt;SigningTime&gt;2014-08-21T06:09:55Z&lt;/SigningTime&gt;
                      &lt;SigningCertificate&gt;
                          &lt;Cert&gt;
                              &lt;CertDigest&gt;
                                  &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" xmlns="http://www.w3.org/2000/09/xmldsig#"/&gt;
                                  &lt;DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;JQ0kZvd0mtXQPA/RTuYV9iuc346tznvN9MoAd/0jNyM=&lt;/DigestValue&gt;
                              &lt;/CertDigest&gt;
                              &lt;IssuerSerial&gt;
                                  &lt;X509IssuerName xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;CN=Nacionalinis sertifikavimo centras (IssuingCA-B),OU=Nacionalinis sertifikavimo centras (NSC),O=Gyventoju registro tarnyba prie LR VRM - i.k. 188756767,C=LT&lt;/X509IssuerName&gt;
                                  &lt;X509SerialNumber xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;1315010063538360283821765366094690&lt;/X509SerialNumber&gt;
                              &lt;/IssuerSerial&gt;
                          &lt;/Cert&gt;
                      &lt;/SigningCertificate&gt;
                      &lt;SignaturePolicyIdentifier&gt;
                          &lt;SignaturePolicyImplied/&gt;
                      &lt;/SignaturePolicyIdentifier&gt;
  </code></pre>
  
  <p>Or some other part of it?</p>
  
  <p>I tried the first one, then letting it through a StylusStudio canonicalization OR <a href="http://www.soapclient.com/xmlcanon.html" rel="nofollow noreferrer">http://www.soapclient.com/xmlcanon.html</a> (both seem to return identical results), which results in this:</p>
  
  <pre><code>&lt;SignedProperties Id="SignedPropertiesElem_0"&gt;
                  &lt;SignedSignatureProperties&gt;
                      &lt;SigningTime&gt;2014-08-21T06:09:55Z&lt;/SigningTime&gt;
                      &lt;SigningCertificate&gt;
                          &lt;Cert&gt;
                              &lt;CertDigest&gt;
                                  &lt;DigestMethod xmlns="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"&gt;&lt;/DigestMethod&gt;
                                  &lt;DigestValue xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;JQ0kZvd0mtXQPA/RTuYV9iuc346tznvN9MoAd/0jNyM=&lt;/DigestValue&gt;
                              &lt;/CertDigest&gt;
                              &lt;IssuerSerial&gt;
                                  &lt;X509IssuerName xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;CN=Nacionalinis sertifikavimo centras (IssuingCA-B),OU=Nacionalinis sertifikavimo centras (NSC),O=Gyventoju registro tarnyba prie LR VRM - i.k. 188756767,C=LT&lt;/X509IssuerName&gt;
                                  &lt;X509SerialNumber xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;1315010063538360283821765366094690&lt;/X509SerialNumber&gt;
                              &lt;/IssuerSerial&gt;
                          &lt;/Cert&gt;
                      &lt;/SigningCertificate&gt;
                      &lt;SignaturePolicyIdentifier&gt;
                          &lt;SignaturePolicyImplied&gt;&lt;/SignaturePolicyImplied&gt;
                      &lt;/SignaturePolicyIdentifier&gt;
                  &lt;/SignedSignatureProperties&gt;
              &lt;/SignedProperties&gt;
  </code></pre>
  
  <p>and then calculating the digest value using these tools:
      <a href="http://www.webutils.pl/index.php?idx=sha1" rel="nofollow noreferrer">http://www.webutils.pl/index.php?idx=sha1</a>
      <a href="http://hash.online-convert.com/sha256-generator" rel="nofollow noreferrer">hash.online-convert.com/sha256-generator</a>
      <a href="http://www.freeformatter.com/message-digest.html#ad-output" rel="nofollow noreferrer">www.freeformatter.com/message-digest.html#ad-output</a></p>
  
  <p>They all returned the same result, but that result is different from the one in the xml file: <em>kOlNXyBs6oSP9hbh+4niZMNQ9OsOCzYhkSYYG4YdHQU=</em></p>
  
  <p>What am I doing wrong? What part of the xml document should I copy and paste into the canonicalizer and then into digest calculator? I've spent several days trying different things and looking for answers and haven't got anything... I am sure I missed something, therefore I am asking for your help.</p>