19.1 Canonicalization Algorithms

Chapter 9 discusses in detail the topic of XML canonicalization and the standard methods for canonicalizing XML. The identifiers for Canonical XML and Exclusive XML Canonicalization are given in Sections 19.1.1and 19.1.2, respectively. The identifier for Minimal Canonicalization, along with a discussion of that algorithm, appears in Section 19.1.3. Both CanonicalizationMethod and Transform elements can use Canonicalization algorithms. See Figure 19-1.

Figure 19-1. Canonicalization and other Transform algorithm element ancestors

Chapters 9, 10 and 15 provide detailed discussions of the use of canonicalization for signatures and encryption. You need to use the appropriate canonicalization for your application but, in the absence of other information, you probably want to use Exclusive XML Canonicalization for signatures and Canoncal XML if you choose to canonicalize XML before encrypting. This advice is contrary to the signature recommendation, which specifies Canonical XML. That recommendation was written before developers recognized the problem of signature robustness in the face of changed XML context and before the specification of Exclusive XML Canonicalization.

19.1.1 Canonical XML

 Canonical XML Identifiers:     http://www.w3.org/TR/2001/REC-xml-c14n-20010315     http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments 

Implementation of Canonical XML without comments, represented by the first identifier in the preceding code, is mandatory for applications that conform to the XML Digital Signature standard. Implementation of Canonical XML with comments is recommended.

In conjunction with XML Encryption applications, implementation of either form of Canonical XML is optional.

An example element follows:

 <CannonicalizationMethod   Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/> 

19.1.2 Exclusive XML Canonicalization

 Exclusive XML Canonicalization Identifiers:     http://www.w3.org/TR/2001/06/xmldsig-excl-c14n#     http://www.w3.org/TR/2001/06/xmldsig-excl-c14n#WithComments 

Implementation of Exclusive XML Canonicalization is optional.

An example element follows:

 <CannonicalizationMethod   Algorithm="http://www.w3.org/TR/2001/06/xmldsig-excl-c14n#"/> 

19.1.3 Minimal Canonicalization

 Minimal Canonicalization Identifier:     http://www.w3.org/2000/09/xmldsig#minimal 

Implementation of Minimal Canonicalization is optional. An example of a minimal canonicalization element follows:

 <Transform   Algorithm="http://www.w3.org/2000/09/xmldsig#minimal"/> 

Minimal Canonicalization was not implemented by any of those parties involved in the XML canonicalization or signature interoperation testing. Its specification is included only because some participants in the XML Security standardization process insisted that they planned to implement it.

The minimal canonicalization algorithm has two steps:

1. Convert the character encoding to UTF-8 (without any byte order mark). If an encoding appears in an XML declaration, remove it. Implementations of Minimal Canonicalization must understand both UTF-8 [RFC 2279] and UTF-16 [RFC 2781] as input encodings. If a non-Unicode input is understood and translated to Unicode, then and only then must you perform text normalization to Normal Form C [NFC].

2. Normalize line endings, as provided by the XML Recommendation [XML] and described in Chapter 9.

This algorithm processes the input octet stream into an output octet stream. If the application has a node-set for the implicit input, then it must convert that node-set into octets. However, Minimal Canonicalization is not particularly appropriate for processing XPath node-sets, the results of same-document URI references, or the output of other types of XML-based Transforms. It is most appropriate for simple character normalization of plain text or possibly well-formed XML that has no namespace or external entity complications.