4G Wireless Network Technology

The name 4G is for further advance invention in wireless networks likely mobile phones to the up coming generation. One contributor in several parts of United States of America only offered it in 2009. Un till now no company contracted to represent 4G mobiles technology, currently it is just only a market term.
The alphabet “G” in term 4G means generation, in wireless networks like cellular phones using “G” technology from last 20 to 30 years. The technology o 1G occupied the first commonly existing cellular phones, the launched of 2G technology in begin of year 1990 brought a digital format of text messaging. After introduced of 3G technology which also brought a great option to carry data or improved info-services of how to carry websites in the original form. Now day’s iPhone is the latest and well-recognized exemplar of 3G mobile technology.
Un till now 4G mobiles is not set up as a contract. Therefore the appearance of 4G merely a market term and somewhat necessities. There should be safe and secure connection of 4G because if it’s high rate data transfer speed. An additional objective is to provide good network coverage because some time it causes trouble when it is use between several network-covered areas. An IP address based network programs should use in 4G mobile technologies for using Internet services.
The two foremost system Wimax and Clearwire, are using 4G mobile technologies within the boundaries of United States of America, a organization where major part of proprietor is Sprint Nextel. In 2008 at Baltimore it was the start of testing services further they planned to spread it out in markets in 2009. So they set up a plan to provide coverage up to 80 cities till end of 2010.
Generally Verizon backs the competitor methods, durable Evolution or LTE. It was probably anticipated that they make it prepared for testing in 2010 but due to the LTE sponsor prevail over some inconvenience by providing higher speed and manufacturing contemptible equipments, it will launch for common usage in 2012.
The Fourth Generation mobile technologies will be commonly used in cellular phones and also in computers for using Internet services. In areas having good network coverage can also avail the services of connection of home broadband without installing any cables and wires. The 4G wireless connections can be easily carried to everywhere for using Internet services and can it use when you are hanging out with friends, airports, subways, and coffee café.

0 comments  

L E M O N J U I C E

The local bar was so sure that its bartender was the strongest man around that they offered a Rs 10,000 bet.

The bartender would squeeze a lemon until all the juice ran into a glass, and hand the lemon to a patron. Anyone who could squeeze one more drop of juice out would win the money.

Many people like weightlifters, wrestlers, body builders, etc had tried over time, but nobody could do it.

One day this scrawny little man came in, wearing thick glasses and a safari suit, and said in a tiny, squeaky voice, "I'd like to try the bet."

After the laughter had died down, the bartender said OK, grabbed a lemon, and squeezed away. Then he handed the wrinkled remains of the rind to the little man.

But the crowd's laughter turned to total silence as the man clenched his fist around the lemon and 5-6 drops fell into the glass.

As the crowd cheered, the bartender paid the Rs 10,000, and asked the little man, "What do you do for a living? Are you a lumberjack, a weightlifter, or what?"

"No," replied the man.

"I work as a project manager in a software company !"

0 comments  

Rajini kanth’s advice to all Project Managers

“Commitment should be there, not commotion,
pressure should be there, but should not be panicky,
softness should be there, should not shout like this …

On a whole a manager should be a manager, not a damager.
You know one thing; Faulty Design document is the root cause for all Bugs”.

LAST BUT NOT THE LEAST!!….
“Highly tensioned Project Manager or a lengthy coding Programmer can never complete a project successfully”.

0 comments  

Project Managers

Team of Managers was given an assignment to measure the height of a flagpole. So theManagers go out to the flagpole with ladders and tape.They’re falling off the ladders, dropping the tape measures - the whole thing is just a mess.

An Engineer comes along and sees what they’re trying to do, walks over,pulls the flagpole out of the ground, lays it flat, measures it from end to end, gives the measurement to one of the managers and walks away.

After the Engineer has gone, one manager turns to another and laughs.”See this idiot. We’re looking for height and he gives the length!”
Moral: “No matter what good you do, Managers can always find fault in you”

0 comments  

Appraisal letter

Dear Manager (HR),

Vivek, my assistant programmer, can always be found

hard at work in his cubicle. Vivek works independently, without

wasting company time talking to colleagues. Vivek never

thinks twice about assisting fellow employees, and he always

finishes given assignments on time. Often Vivek takes extended

measures to complete his work, sometimes skipping coffee

breaks. Vivek is a dedicated individual who has absolutely no

vanity in spite of his high accomplishments and profound

knowledge in his field. I firmly believe that Vivek can be

classed as a high-caliber employee, the type which cannot be

dispensed with. Consequently, I duly recommend that Vivek be

promoted to executive management, and a proposal will be

sent away as soon as possible.

Signed - Project Leader

NB: That stupid idiot was reading over my shoulder when I wrote the report sent to you earlier today. Kindly read only the odd lines (1, 3, 5, 7, 9,11, 13) for my true assessment of him.

0 comments  

Upcoming Telugu top 50 Block Busters....

Upcoming Telugu Block Busters
1) IT Rajyam!!
2) Job ochina kothalo....!
3) A Company aithe naakenti..!?,
4) Job vachindhi kaani.....!
5) Fire aina Mogudu - Job vachhina pellam
6) Priyudu nerpina PASCAL,
7) Pellam PM aithe!!?,
8) Project dorakani Papa,
9) Company pettalani vundhi..!
10) Iddaru programmerla muddula tester
11) Job-e-naa pranam!,
12) Oracle dada-DBMS!,
13) Toli project...!
14) Yevandi mailochindi,
15) Project kosam,
16) Coding Ramudu
17) Intlo baava - Office lo Java,
18) Aaruguru programmerlu!!!,
19) Pandanti Project!
20) COBOL kaatesindi,
21) Programmer malli puttadu..!,
22) Sri SAP Swamy Mahatyam...!!,
23) Offshore lo puli - Onsite lo pilli
24) ...Nee Password Naaku Telusu !
25) Amma,Nanna,O'software engineer!!
26) Srivaariki Oka E-Mail,
27) Review cheddam raa,
28) Naakuuu...Project kaavaali..!
29) ...Sorry... naaku already job vundi,
30) Testing ante ideraa
31) Vaddu Bava....Java!!
32) Pavitra project!!
33) Basics Nerpina Bava...!!
34) Mogudu,Pellam,.. O'project!!
35) Ammo! Project Delivery!?
36) Premalo....PM,Programmer!
37) PM..! Vastunnadu jaagratha!!
38) Onsite andagaadu - Offshore Sundari,
39) Evadi coding vaadidhi!!
40) Repati Programmerlu..!
41) Vaadu Proggrammer Kaadu....!
42) Adirindayya Tester!!!
43) Programmer,Tester Madhyalo Bug!!
44) Developer....Chandra kanth!!
45) Wipro Mogudu,Infy Pellam!!
46) Avunu! Vaalliddaru Testerlu!!
47) Tester No:1
48) Nuvvu,Nenu...Project!
49) Project Chesi Choodu!!
50) PM Chebithe Vinaali!!!

0 comments  

WeddingQuery -SQL Style

CREATE PROCEDURE MyMarriage
BrideGroom Male (25) ,
Bride Female(20) AS
BEGIN

SELECT Bride FROM india_ Brides
WHERE FatherInLaw = 'Millionaire' AND Count(Car) > 20 AND HouseStatus ='ThreeStoreyed'
AND BrideEduStatus IN (B.TECH ,BE ,Degree ,MCA ,MiBA) AND Having Brothers= Null AND Sisters =Null

SELECT Gold ,Cash,Car,BankBalance FROM FatherInLaw
UPDATE MyBankAccout SET MyBal = MyBal + FatherInLawBal
UPDATE MyLocker SET MyLockerContents = MyLockerContents + FatherInLawGold
INSERT INTO MyCarShed VALUES ('BMW')
END

GO

Then the wife writes the below query:
.
.
.
.
.
.
.
.
.
.
DROP HUSBAND;
Commit;

0 comments  

A mind blowing love story

Hero loves heroine...........

but Heroine loves Villain...........

but Villain loves Hero`s Sister..........

but Hero`s Sister loves Heroine`s Brother..........

but Heroine`s Brother loves Villain`s Sister..........

but Villain`s Sister loves Hero`s Brother..........

but Hero`s Brother loves Heroine............

but Heroine loves Villain.

Finally two persons commit SUICIDE.

Guess WHO ?????????
.
.
.
.
.
.
.
.
.

The PRODUCER and The DIRECTOR.

0 comments  

Girls looking for software bridegrooms

A conversation abt the process of selecting a software bridegroom. Enjoy reading.

Vidhya: hey! what is the matter you have called up all of a sudden?

Nithya : do u remember that my parents gave my horoscope, to search for a suitable match, to many people? So many horoscopes of the groom has come.. in that 4-5 seems to match.. I don't know which one to select, I am confused because of it.

Vidhya: what is the confusion about?

Nithya: horoscopes of many software engineers have come. It seems now a days, the software guys are wanting to marry girls in the other field. That's I why I don't know whom I must select among this. You are a software engineer na pls give me some suggestion .

vidhya: not a problem at all. So tell me the position that each one holds.

nithya: first is a manager.

vidhya: manager?? Then he will showcast himself that he is busy always. But he will not do anything properly. He will get u 1 kg of rice and ask you to prepare for the whole area say a village. He will get you mutton and ask you to prepare chicken 65. Even if you protest telling you can't make it, he'll not accept. He will tell you to work hard day and night to prepare it. He will also tell he'll provide you with the night cab. Even if you ask how can I prepare chicken 65 out of it by sitting day and night he will not accept.

nithya: ohh..so dangerous he is!! Then I must escape. Next is a test engineer.

vidhya: he is more dangerous than the other person. Whatever you do he will correctly tell only the fault in it. Even if you try to surprise him with 10 variety of food, he will tell the item which does not have salt in it. If you ask him "will you not at least tell that it is good", he will reply back saying it is your duty to make it good so why must I tell that. He is sooo good ...

Nithya: then a NOto him also. Next is the performance test engineer.

vidhya: he is another specimen.. even if everything is good, he will ask why did it take this much time. If you take 10 minutes to make a coffee, he will question you asking why you have taken 10 min for a coffee which can be done within 5 min. Even if you say that he is talking about the instant coffee while you have made the filter coffee, he will not accept. The same will be with all the work you do. You must not think about this person if you want to do make up in your life !!!

Nithya: then! you mean to say that we should not marry software guys??

Vidhya: who said like that?? In software there is one more group. They are called the developers group. How much ever you hit them they will bear.

Nithya: then tell about them.

Vidhya: you don't have to do anything. They will do everything themselves. If we sit back and just boost them it is enough. But the problem with them is- they will say "I know it" whatever you ask them.

Even that is ok. They will bear how much ever you hit them but the condition is you must keep saying "you are too good" after hitting them every time.

Nithya: this is superb. Then we must search for this kind of a groom....

0 comments  

Browsers vs Political Parties in Andhra Pradesh

nternet Explorer - Telugu Desam Party
Once ruled the kingdom and now loosing its share in the browser market.

Mozilla Firefox - Congress
Addressing all the needs and understanding the low level requirements. Thus becoming popular day by day.

Opera - BJP
With eye candy interface and a major player in Indian Political Internet.

Google Chrome - Chiranjeevi's Praja Rajyam Party
Browser with very few facilties and one basic need - viewing webpages without any corruption

Konqueror - TRS (and all telengana demanding parties)
Main dependancy is to run on a seperate Linux KDE - Kindly Divert Everyone

Epiphany - CPM
One man army running alone on the concept of socialism.

0 comments  

Letter from Banta Singh Bill Gates

Subject: Problems with my new computer

Dear Mr. Bill Gates,
We have bought a computer for our home and we have found some problems, which I want to bring to your notice.

1. There is a button 'start' but there is no "stop" button. We request you to check this.

2. We find there is 'Run' in the menu. One of my friends clicked 'run' he ran up to Amritsar ! So, we request you to change that to "sit", so that we can click that by sitting.

3. One doubt is whether any 're-scooter' is available in system? I find only 're-cycle', but I own a scooter at my home.

4. There is 'Find' button but it is not working properly. My wife lost the door key and we tried a lot trace the key with this ' find' button, but was unable to trace. Please rectify this problem.

5. My child learnt 'Microsoft word' now he wants to learn 'Microsoft sentence', so when you will provide that?

6. I bought computer, CPU, mouse and keyboard, but there is only one icon which shows 'MY Computer': when you will provide the remaining items?

7. It is surprising that windows says 'MY Pictures' but there is not even a single photo of mine. So when will you keep my photo in that.

8. There is 'MICROSOFT OFFICE' what about 'MICROSOFT HOME' since I use the PC at home only.

9. You provided "My Recent Documents". When you will provide "My Past Documents"?

10. You provide "My Network Places". For God sake please do not provide "My Secret Places". I do not want to let my wife know where I go after my office hours.

11. Last one from me to Mr Bill Gates :

Sir, how is it that your name is Gates but u are selling WINDOWS?

Yours obediently,
Banta Singh
Punjab

0 comments  

Side effects of working in the IT sector

Bhavik:
I once went out to the market wearing my ID card and did not realize till my friend told me why I was wearing it !!!!

Ashok:
Few days back I slept at 11:30 in the ni8 and woke up in the morning at 7:00 and suddenly thought that I haven't completed 9.15 hours and laughed at myself when I realised abt that.

Jyotsna:
One from me too...
Just after our training completion in Mysore Dc and postings to Pune, me and my friends went out for dinner in one of the best restaurants. .
And as I finished.. I started walking towards the Basin with plates in my hand.. :)

Abhijeet:
Jus to add...
Once I was on call with my father and mom was not around. I went on to ask, "why is she not attending the status call?"

Anup:
I don't login to orkut, yahoo, gmail, youtube, etc.. at my personal internet connection at home... thinking it will be blocked any way.
Till I realize - I am at home.

Rohit:
Yeah sometimes it do happens with me also........ ....while writing personal mails also........ .I jus use the way as if I am writing to onsite or some senior person...... ..
Jus forget that we are jus mailing our friends..... .........
And keeping hands in front of tap for waiting water to drop by itself is very frequent with me.......... .....I jus forget that we have to turn on and off the tap......... ..

Nidhi:
Awesome!!
Once after talking to one of my friend. I ended the conversation saying ..." Ok bye...in case of any issues will call u back"
(Hilarious!)

Nisha:
Sometimes when I mistakenly delete a message
from my mobile, I hope for a second, maybe its in the recycle bin

Farina:
I was about to throw my hanky into the bin after drying my hand.

Bhabani:
Once I was flashing my ID card instead of unlocking the door with the keys.

Nisha:
Kinda a same experience for me too..
I gave my office mail id and pwd to access Gmail and wondered when did they become invalid???

Sandy:
I have a experience to share tooo .. I was earlier working at the back office of an international Bank. We used to 'dispatch' lot of Credit / Debit cards and statements for the customers and track its delivery later.
Once my granma was admitted in a hospital, my team mate once casually asked me " howz ur granma doing now ? still in hospital ? " ... and i replied to her " She is better now , she will dispatched from the hospital tomorrow !"
This was followed by a loud laugh in the entire bay !

Sandeep:
Once I went to a pharmacy n asked for a tab....pharmacist asked whr I want 250mg r 500mg.....suddenly I replied as 256mg...lol. ...thank god he didn't noticed tht....

Ashwin:
Me getting a thought of doing an Alt+Tab while switching from a news channel to the DVD while watching TV.

Vidyarthi:
And I - after a forty hour marathon in Bhubaneshwar with Powerbuilder, decided to take a break and went to a movie. In the middle of the movie, when I wanted to check the time, I kept repeatedly glancing at the bottom right corner of the silver screen!

Venu:
Few of my friends and myself decided to go out for dinner. The place wasn't fixed yet. I said we shall decide it "run time"

Krishna:
When I went to a movie theatre from office directly.. I showed the guy at the entrance my ID card and walked in... he had to call me back asking the ticket...

Rama:
One late night when I went home after work, I was trying to flash my id card to open the lock and only after few secs, I realised what i'm trying to do

Sridhar:
Once I went to have juice at the local juice vendor and innocuously asked him whether he had a plain 'version' of lemonade.

Arun:
Few years back my shogun engine stopped on Bangalore MG Road as the petrol came to reserve. I told my friend I need to restart my bike!

Satya:
The other day I was hearing one guy talking of a "Standalone" house.. when he was actually intending a independent house... Poor broker shud have tuff time trying to find a " Alone house standing in a huge empty area... " don't know what interpretations the guy must have made.

0 comments  

Joke

1) MR. BEAN SEES A DOCTOR:

Doctor : I regret to tell you that you have a brain tumour.
Mr. Bean : Yesss!!! (jumps in joy)

Doctor : Did you understand what I just told you?
Mr. Bean : Yes of course, do you think I’m dumb?

Doctor : Then why are you so happy?
Mr. Bean : Because that proves that I have a brain!

2) MR. BEAN WHILE IN GRADE SCHOOL:
Teacher : What is 5 plus 4?
Mr. Bean : 9
Teacher : What is 4 plus 5?
Mr. Bean : Are you trying to fool me, you’ve just twisted the figure, the answer is 6!!

3) WHILE IN A DRUG STORE:
Mr. Bean : I’d like some vitamins for my grandson.
Clerk : Sir, vitamin A, B or C?
Mr. Bean : Any will do, my grandson doesn’t know the alphabet yet!!

4) AT AN ATM MACHINE:
Friend : What are you looking at?
Mr. Bean : I know your PIN no., hee, hee.
Friend : Alright, what is my PIN no. if you saw it?
Mr. Bean : four asterisks (****)!

5) MARRIAGE:
Friend : How many women do you believe must a man marry?
Mr. Bean : 16
Friend : Why?
Mr. Bean : Because the priest says 4 richer, 4 poorer, 4 better and 4 worse.

6) CHATTING WITH HIS FRIEND:
Friend : How was the tape you borrowed from me, is it Ok?
Mr. Bean : What do you mean ok, I thought it’s a horror film. I didn’t see any picture.
Friend : What tape did you take anyway?
Mr. Bean : Head Cleaner.

7) DEATH OF HIS MOTHER:
Mr. Bean crying) the
doctor called, Mom’s dead.
Friend : condolence, my friend.
(After 2 minutes) Mr. Bean cries even louder
Friend : what now?
Mr. Bean : my sister just called, her mom died too!

MR. BEAN ATTENDING A MEETING:
Colleague : Sorry I’m late. I got stuck in an elevator for 4 hrs because of a power failure.
Mr. Bean : That’s alright, me too…I got stuck on the escalator for 3 hrs.

9) SPELLING LESSON:
Mr. Bean’s Son: Dad, what is the spelling of successful….is it one c or two c?
Mr. Bean : Make it three c to be sure!

0 comments  

Exchange Data More Securely with XML Signatures and Encryption

The XML Signature and XML Encryption standards are being used extensively as building-block technologies. Microsoft® Office InfoPath uses XML signatures to sign partial or whole forms. Web services use XML signatures to sign SOAP messages and XML encryption to encrypt them. The XML manifests for ClickOnce®-based applications, new in Visual Studio® 2005, also use XML signatures. The .NET Framework 1.x includes an object model for the XML Signature standard, and the .NET Framework 2.0 adds additional support, while adding an object model for XML encryption as well. This article explains the XML Signature and XML Encryption standards and shows you how to use them with .NET. For the actual XML Signature specification, see the W3C standard at XML-Signature Syntax and Processing.

Digital Signing
Before we dive into the XML Signature standard, let's review the basics of digital signing. Because it's important to prevent a malicious user from altering a message during transmission, digital signing protects the integrity of data and can detect any changes made to it while it's en route to its recipient. Because it's also important to be able to identify a sender, a message is typically signed using the private (secret) key of the sender and verified with the corresponding public key, allowing recipients to confirm the identity of the sender when they know the sender's public key. This prevents a malicious user from pretending to be a known sender, either by trying to send messages as the known sender or by intercepting messages from the known sender and replacing them with their own—a form of the man-in-the-middle attack.
To create a digital signature, first hash the message you are signing using a cryptographic hash function. For any length of input, a cryptographic hash function returns a fixed-length set of bits called the hash value. This hash value cannot be easily converted back to the input. The hash value changes unpredictably when even a single bit changes in the input, so someone cannot find an input that is similar to the original just by finding a similar hash value. One commonly used hash function is SHA-1, which produces a 160-bit hash value.
The next step is to sign the hash value using a signing algorithm and your private key to produce a signature value. You create the signature with your private key so others who have your public key can verify it (more on that later in the article). RSA is a popular cryptographic algorithm to use with signatures.
After you've sent the message and this signature to the recipient, the verification process begins. The received message is hashed with the same hash function used when signing. Then the signature value is verified by passing it, along with the public key and the computed hash, to the signing algorithm. If the computed hash and the signature hash match, then the signature is valid. If the hashes don't match, either the data or the signature has been changed and therefore the integrity of the data is not assured.
You can also sign and verify data using a keyed hash algorithm, but that's beyond the scope of this article. The .NET Framework already includes a rich set of classes for all kinds of hashing, encryption/decryption, and signing/verification algorithms. For more information on these, see the .NET Framework SDK documentation and .NET Framework Security, by Brian LaMacchia, et al (Addison-Wesley, 2002).

XML Signature Basics
You can sign any kind of data using XML Signature, including part of an XML document, other XML documents, or other data of any format. However, in practice, XML signatures are most frequently used to sign other data represented in XML. The XML Signature standard is also very flexible, allowing you to filter and transform your data before you sign it and letting you choose exactly what to sign and how.
Let's take a look at a simple XML Signature scenario: signing an entire document and including the signature in it (see Figure 1). Notice the Signature element that has been added to the document. This element contains the XML signature. Let's look at what each element contains.

A simple document:
<docRoot>
  <a>Hello</a>
  <b>World</b>
</docRoot>
The document when signed:
<docRoot>
  <a>Hello</a>
  <b>World</b>
  <Signature xmlns="http://www.w3c.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod
        Algorithm="http://www.w3c.org/TR/2001/REC-xml-c14n-20010315"/>
      <SignatureMethod
        Algorithm="http://www.w3c.org/2000/09/xmldsig#rsa-sha1"/>
      <Reference URI="">
        <Transforms>
          <Transform
          Algorithm=
          "http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
        </Transforms>
        <DigestMethod
          Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
        <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>IoEwS(3 lines of Base64 text)XSo=</SignatureValue>
  </Signature>
</docRoot>
SignedInfo The children of this element contain all the information about what is signed and how it was signed. The signature algorithm is actually applied to this element and all of its children to generate the signature.
CanonicalizationMethod This specifies the canonicalization (C14N) algorithm used on the SignedInfo element to normalize the XML. We'll talk more about C14N later in the article.
SignatureMethod This element specifies the signature algorithm for this signature. In this example, the signature algorithm is SHA-1 (for hashing) with RSA (for signing the resulting hash value).
Reference These elements specify the data that will be signed and how it should be processed before hashing. The URI attribute, representing the Uniform Resource Identifier, identifies the data to be signed, while the Transforms element (described later) specifies how to process the data before hashing. In this example, we're using a special URI, the empty string, which specifies that the document containing the signature is the data to be included in the signature.
The XML Signature standard uses an indirect signing mechanism for Reference data. Rather than hashing and then encrypting the hash value for all of the data from the Reference, the standard hashes the data for each Reference, using the algorithm specified by the Reference's DigestMethod element, and then stores the hash value in the DigestValue element of the Reference. Then the SignedInfo element and all of its children (including the Reference elements) are hashed; that hash value is encrypted to generate the signature. So you're really signing the hash of the hash of data referred to in Reference elements, but this scheme still protects the integrity of the data. Figure 2 and Figure 3 show the signing and verification process alongside the matching XML.
Transforms Each Reference element can have zero or more transforms specified for it. These transforms are applied to the data for the Reference in the order they are listed in the XML. Transforms allow you to filter or modify the data for the Reference before the data is hashed. In this example, we're using the enveloped signature transform, which selects all of the XML in the containing document except for the Signature element. We must remove the Signature element from the data to be signed; otherwise we would be modifying the data we're trying to sign when we store the signature value. We'll talk more about transforms later in the article.
SignatureValue This element contains the signature value computed by signing the SignedInfo element and all of its children.
Figure 2 Signing Process 
Now let's discuss the processing model for creating a signature (see Figure 2). First, for each Reference element in the signature:
  • Apply each transform algorithm specified in the Transform elements to the data for the Reference, in the order the transforms appear under the Transforms element.
  • Hash the transformed data using the hashing algorithm specified by the DigestMethod element of the Reference.
  • Store the resulting hash value in the DigestValue element of the Reference.
The next step is to canonicalize the SignedInfo element and its children using the algorithm specified in the CanonicalizationMethod element of the signature. Then you sign the SignedInfo element and its children using the algorithm specified in the SignatureMethod element of the signature. The signature value is stored in the eponymous SignatureValue element.
Figure 3 Verification Process 
Signature verification is the inverse of the process just described (see Figure 3). First, you must canonicalize the SignedInfo element and its children using the C14N algorithm specified in the CanonicalizationMethod element. Then you must verify the signature value stored in the SignatureValue element against the SignedInfo element and its children.
Finally, for each reference element in the signature:
  • Apply each transform algorithm specified in the Transform elements of the Reference to the data for the Reference, in the order the transforms appear under the Transforms element.
  • Hash the transformed data for the reference using the hashing algorithm that is specified by the DigestMethod element of the reference.
  • Compare the hash value computed with the value stored in the DigestValue element.
If the signature verification succeeds and the hash value for each reference is equal to the one stored in the signature, the XML signature is valid. Otherwise, either the data referred to by one of the reference elements has changed, or the signature element has been changed.
A signature embedded in the document it signs is called an enveloped signature. The code to create this kind of signature is shown in Figure 4. The code to verify the signature is shown in Figure 5.
using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
// Also, add a reference to System.Security.dll

// Load the signed data
XmlDocument doc = new XmlDocument();
doc.PreserveWhitespace = true;
doc.Load("data-signed.xml");

// Find the Signature element in the document
XmlNamespaceManager nsm = new XmlNamespaceManager(new NameTable());
nsm.AddNamespace("dsig", SignedXml.XmlDsigNamespaceUrl);
XmlElement sigElt = (XmlElement)doc.SelectSingleNode(
  "//dsig:Signature", nsm);

// Load the signature for verification
SignedXml sig = new SignedXml(doc);
sig.LoadXml(sigElt);

// Verify the signature, assume the public key part of the
// signing key is in the key variable
if (sig.CheckSignature(key))
    Console.WriteLine("Signature verified");
else 
    Console.WriteLine("Signature not valid");
using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
// Also, add a reference to System.Security.dll

// Assume the data to sign is in the data.xml file, load it, and
// set up the signature object.
XmlDocument doc = new XmlDocument();
doc.Load("data.xml");
SignedXml sig = new SignedXml(doc);

// Make a random RSA key, and set it on the signature for signing.
RSA key = new RSACryptoServiceProvider();
sig.SigningKey = key;

// Create a Reference to the containing document, add the enveloped
// transform, and then add the Reference to the signature
Reference refr = new Reference("");
refr.AddTransform(new XmlDsigEnvelopedSignatureTransform());
sig.AddReference(refr);

// Compute the signature, add it to the XML document, and save
sig.ComputeSignature();
doc.DocumentElement.AppendChild(sig.GetXml());
doc.Save("data-signed.xml");
You've seen how to create and verify enveloped signatures. While they are commonly used and handy for signing entire XML documents, the XML Signatures standard lets you sign other data as well by specifying different URIs in the Reference element. So let's take a look at different types of references next.

References
In addition to enveloped references (a Reference element that has an empty string for the URI attribute), there are two other broad types of references defined in the XML Signature standard: references to detached data and references to XML data by ID. Detached data is outside of the XML document containing the signature. These references can point to another XML document or to any other type of resource. You would typically use this type of reference when signing multiple resources in one signature, such as an XML document and some other files that are referred to by the document. The following XML code fragment shows an example of a detached reference:
<Reference URI="http://www.example.com/foo.jpg">
  <DigestMethod
    Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1" />
  <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
</Reference>
In order to create a detached reference using the Framework classes, you simply set the URI of the reference to the URI of the resource when creating the reference object, and then add the reference to the signature, as shown here:
// Create a Reference to detached data, assume a SignedXml object in sig
Reference refr = new Reference("http://www.example.com/foo.jpg");
sig.AddReference(refr);
References to XML data by ID point to XML within the document containing the signature or within the signature itself. For these references, the signature engine looks for an element with an Id attribute that matches the URI in the reference, not including the #. Here's an example of an ID-based reference:
<Reference URI="#myData">
  <DigestMethod
    Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1" />
  <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
</Reference>
If the element with the Id of "myData" is in the document containing the signature, this reference is complete and the signature engine will find it when processing the signature. You would typically use this type of reference to limit the scope of a signature to a specific part of an example document. For example, in a document processing application, a reviewer would only sign the portions of the XML document she reviewed, not the entire document.
The standard also allows you to add arbitrary data to the signature in an Object element. The XML for an Object element looks like the following line of code:
<Object Id="myData">Your XML goes here</Object>
To create an ID-based reference to an element that is already in the document containing the signature, add code like this:
// Create a Reference to XML data in the containing document,
// assume a SignedXml object in sig
Reference refr = new Reference("#myData");
sig.AddReference(refr);
If the ID-based reference is to an Object element in the signature, you must also add a DataObject to the signature in addition to adding the reference, as in the code that was just shown. The data object can contain any XML that you pass in.
// Adds a DataObject with an Id of "#myData" to the signature, assume a 
// SignedXml object in sig, and xml data of type XmlNodeList in data
DataObject dobj = new DataObject();
dobj.Id = "myData";  // Note: no #
dobj.Data = data;    // XML Data of the Object
sig.AddObject(dobj);
You would typically use a reference to an Object element for signing metadata about the signature, such as a unique identifier for the signer or some other information about the signature.

Transforms
Transforms give you even more control over the content signed by allowing you to modify the data for a reference before the hash value for that data is generated. The enveloped signature transform, for example, removes the Signature node from the XML document before signing it. A reference can specify any number of transforms, which are applied in the order specified in the Transforms element. The .NET Framework classes support the following transforms in addition to the enveloped signature transform that we mentioned earlier:
  • Any canonicalization algorithm can be used as a transform.
  • The Base64 transform allows you to decode data in the Base64 encoding.
  • The XSLT transform allows you to apply an XSLT stylesheet to XML data before signing it. The XSLT stylesheet to be applied is specified as XML under the Transform element.
  • The XPath transform allows you to filter XML data with an XPath expression.
The XPath expression is specified as the text content of an XPath element under the Transform element. It's important to note that the XPath transform acts as a filter, not as a means of selecting nodes in the XML being passed as input. The transform evaluates the XPath expression against each node passed as input to the transform, and the result is converted to a Boolean. An input node is considered to pass the evaluation and will be included in the output of the transform if the result of the evaluation is true. Consider the following XML input to the transform:
<a>
  <b>Some data</b>
  <c>More data</c>
</a>
<d>
  <b>Even more data</b>
</d>
Let's say we only want to select "b" nodes for signing. An XPath transform with the XPath expression of "ancestor-or-self::b" will return the following nodeset, which is what we want:
<b>Some data</b>
<b>Even more data</b>
The Transform element for this XPath expression would look like the following code snippet:
<Transform
  Algorithm="http://www.w3c.org/TR/1999/REC-xpath-19991116">
  <XPath>ancestor-or-self::b</XPath>
</Transform>
To create transforms programmatically when signing, create an instance of a transform object, set its properties appropriately, and add it to the reference to which it applies. The following example adds the XPath transform used in the previous example to a reference to create a transform:
// Add an XPath transform to a reference.
// Assume a Reference object in refr 
XmlDocument doc = new XmlDocument();
doc.LoadXml("<XPath>ancestor-or-self::b</XPath>");
XmlDsigXPathTransform xptrans = new XmlDsigXPathTransform();
xptrans.LoadInnerXml(doc.ChildNodes);
refr.AddTransform(xptrans);

Canonicalization
The purpose of canonicalization is to produce the same XML data for two XML fragments that are logically the same, but may not be represented by the same text. For example, take a look at the following two code fragments. They are logically the same; they differ only in text representation. But if you were to hash both of them as is, the hash values would be different:
<root>
  <a   >Some text</a>
  <b attr1="yes" attr2="no"></b>
  <c    Id="foo">More text</c>
</root>

<root>
  <a>Some text</a>
  <b attr2="no" attr1="yes" />
  <c Id="foo">More text</c>
</root>
To avoid this problem, the default canonicalization algorithm specified in the standard performs a number of tasks including the removal of white space in start and end tags and the conversion of empty elements to start/end tag pairs. It does not, however, change any white space in the content of elements. The complete list of operations performed is available in the Canonical XML recommendation, located at Canonical XML.
The signature engine automatically canonicalizes data when necessary to comply with the W3C standard. Specifically, the signature engine canonicalizes XML data anytime it needs to convert it to binary data for hashing. This happens when it prepares to sign the SignedInfo element and its children, for instance. It also may happen when preparing a reference or the output of a transform for signing. For example, if you use an ID-based reference to other XML data in the document containing the signature, and the reference has no transforms associated with it, the signature engine will canonicalize the XML data for that reference before hashing the data.

Key Management
The XML Signature standard provides the KeyInfo element to help with key management. This element can store a key name, key value, key retrieval method, or certificate information to help receivers verify the signature. The standard does not specify how or if any information in the KeyInfo element should be trusted.
The KeyInfo element can be useful when the sender and recipient share a list of trusted keys or if you come up with some other method for mapping key names to keys, for example. The .NET Framework 1.x has some support for key name, value, and retrieval method. The .NET Framework 2.0 also includes support for X.509 certificates.
Let's say the sender and recipient share a list of keys. The recipient has a public key for each sender from whom she expects to receive messages. The signing application can add the following code to add a KeyInfo element to the signature:
// Adds an KeyInfo element with RSA public key information to the 
// signature. 
// Assumes a SignedXml object in sig, and an RSA object in key.
KeyInfo ki = new KeyInfo();
ki.AddClause(new RSAKeyValue(key));
sig.KeyInfo = ki;
This code should be added before ComputeSignature is called. It will produce a KeyInfo element in the signature that looks something like the following code:
<KeyInfo><KeyValue><RSAKeyValue>
  <Modulus>4LfG(2 lines of Base64 text)2Fr=</Modulus>
  <Exponent>AQAB</Exponent>
</RSAKeyValue></KeyValue></KeyInfo>
This represents the RSA public key used to sign the XML document. The receiving application should compare this key to a list of trusted keys and should not trust the document if the public key is not on the list. Otherwise an attacker could replace a signed document while in transit, signing it with another key. If a signature includes an RSAKeyValue like this, the verification code can call the CheckSignature method of the SignedXml class that takes no parameters, and the .NET Framework will figure out the key from the RSAKeyValue element. Here's an example:
// Verify a signature that includes RSAKeyInfo or DSAKeyInfo.
// Assume a SignedXml object in sig.
bool verified = sig.CheckSignature();

Signature Profiles
Along with the flexibility of XML signatures comes some amount of risk. In particular, because transforms are so flexible, it can be difficult to figure out exactly what data was covered by the signature, which can lead to unexpected or insecure results. These signature profiles can help in this regard by specifying the form of signature your application supports. While there is no standard for signature profiles a signature profile should at the least specify references and transforms that the application expects for a signature, so you can be sure that the data you expect to be signed is indeed signed. Signature profiles could also contain additional data, such as signing algorithms or key sizes expected for signed data. Your application should check and enforce that those signatures it creates and verifies comply with the signature profile that your application supports.
To better understand why profiles are important, consider Figure 1. Suppose you are writing an application that accepts XML signed data, but your application only expects signatures that use the enveloped signature transform and no other transforms. Now someone sends you a signed document with an extra XPath transform, as shown in Figure 6.
<docRoot>
  <a>Hello</a>
  <b>World</b>
  <Signature xmlns="http://www.w3c.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod
        Algorithm="http://www.w3c.org/TR/2001/REC-xml-c14n-20010315"/>
      <SignatureMethod
        Algorithm="http://www.w3c.org/2000/09/xmldsig#rsa-sha1"/>
      <Reference URI="">
        <Transforms>
          <Transform
            Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-
              signature"/>
          <Transform
            Algorithm="http://www.w3c.org/TR/1999/REC-xpath-19991116">
              <XPath>ancestor-or-self::a</XPath>
         </Transform>
       </Transforms>
       <DigestMethod
         Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
       <DigestValue>mN4R0653F4ethOiTBeAu+7q0Be=</DigestValue>
     </Reference>
    </SignedInfo>
    <SignatureValue>X4Ie(3 lines of Base64 text)nP3=</SignatureValue>
  </Signature>
</docRoot>
In the example in Figure 6, the signature only covers the "a" element in the sample document. If you just loaded the document and called the CheckSignature method of the SignedXml class, the signature may still verify even though the "b" element is not covered by the signature, because the signature engine will apply the transform specified in the signature. If your application relies on the "b" element being covered in the signature, the integrity of your data has been compromised. The application should verify the signature profile it expects by checking that there is just one reference that has an empty string as the URI and that the reference has one transform: the enveloped signature. It would reject any other signature profile when verifying a signature. Some sample code that checks this signature profile is shown in Figure 7.
// This method checks the signature profile for the signature
// in the supplied document. It ensures there is only one
// Signature element and only one enveloped reference with only
// one enveloped signature transform
public bool CheckSignatureProfile(XmlDocument doc)
{
    // Make sure there is only one Signature element
    XmlNamespaceManager nsm = new XmlNamespaceManager(new NameTable());
    nsm.AddNamespace("dsig", SignedXml.XmlDsigNamespaceUrl);
    XmlNodeList sigList = doc.SelectNodes("//dsig:Signature", nsm);
    if (sigList.Count > 1)
        return false; //Wrong number of Signature elements

    //Make sure the Signature element has only one Reference
    XmlElement sigElt = (XmlElement)sigList[0];
    XmlNodeList refList = sigElt.SelectNodes(
        "dsig:SignedInfo/dsig:Reference", nsm);
    if (refList.Count > 1)
        return false; //Wrong number of Reference elements

    // Make sure the Reference URI is ""
    XmlElement refElt = (XmlElement)refList[0];
    XmlAttributeCollection refAttrs = refElt.Attributes;
    XmlNode uriAttr = refAttrs.GetNamedItem("URI");
    if ((uriAttr == null) || (uriAttr.Value != ""))
        return false; // Wrong type of reference

    // Make sure the only tranform is the enveloped signature transform
    XmlNodeList transList = refElt.SelectNodes(
        "dsig:Transforms/dsig:Transform", nsm);
    if (transList.Count != 1)
        return false; //Wrong number of Transform elements
    XmlElement transElt = (XmlElement)transList[0];
        string transAlg = transElt.GetAttribute("Algorithm");
    if (transAlg != SignedXml.XmlDsigEnvelopedSignatureTransformUrl)
        return false; //Wrong type of transform

    return true;
}
So far, we've looked at some different aspects of the XML Signature standard and the support for it in the .NET Framework. Let's put some of these features together into a more complete example. Suppose you're writing an application to exchange messages in XML and you want to sign the entire content of the message. You also want to add some XML data about the signer to the signature element as an object, only signing the signerID element of this data. Your application has access to a well-known list of keys, so you will also store the public key information in the signature and check to make sure the key maps to a well-known key during verification. The code for signing and verifying a message is included in the complete code download for this article. Signing a message with this code will produce an XML signature that looks something like Figure 8.
<root>
  <myData1>Some Data</myData1>
  <myData2>More data</myData2>
  <Signature xmlns="http://www.w3c.org/2000/09/xmldsig#">
    <SignedInfo>
      <CanonicalizationMethod
        Algorithm="http://www.w3c.org/TR/2001/REC-xml-c14n-20010315"/>
      <SignatureMethod
        Algorithm="http://www.w3c.org/2000/09/xmldsig#rsa-sha1"/>
      <Reference URI="">
        <Transforms>
          <Transform
           Algorithm=
           "http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
        </Transforms>
        <DigestMethod
          Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
        <DigestValue>cbPT0951Ghb2G3UjpVjWw+7q0Bc=</DigestValue>
      </Reference>
      <Reference URI="#signer">
        <Transforms>
          <Transform
          Algorithm=
          "http://www.w3c.org/TR/1999/REC-xpath-19991116">
            <XPath xmlns:my="http://example">
              ancestor-or-self::my:SignerID
            </XPath>
          </Transform>
        </Transforms>
        <DigestMethod
          Algorithm="http://www.w3c.org/2000/09/xmldsig#sha1"/>
        <DigestValue>mN4R0653F4ethOiTBeAu+7q0Be</DigestValue>
      </Reference>
    </SignedInfo>
    <SignatureValue>IoEwS...</SignatureValue>
    <KeyInfo>
      <KeyValue>
        <RSAKeyValue>
          <Modulus>4LfG(2 lines of Base64 text)2Fr=</Modulus>
          <Exponent>AQAB</Exponent>
        </RSAKeyValue>
      </KeyValue>
    </KeyInfo>
    <Object Id="signer">
      <my:SignerData xmlns:my="http://example">
        <my:SignerName>Mike</my:SignerName>
        <my:SignerID>4815</my:SignerID>
      </my:SignerData>
    </Object>
  </Signature>
</root>

New Features in the .NET Framework 2.0
All the XML Signature features discussed so far are available in both the .NET Framework 1.x and 2.0. XML Encryption and X.509 certificate integration are new to version 2.0. X.509 certificate integration makes it easier to use X.509 certificates with XML Signature. The new X509CertificateEx class and related classes make it easier to manipulate and use certificates, and the XML signing object model uses these classes when appropriate. We'll talk more about X.509 integration at the end of this article.
XML Encryption is another W3C standard. Just as XML Signature specifies a format and processing model for creating digital signatures in XML, XML Encryption standardizes how to encrypt data in XML. XML digital signatures are driven through the SignedXml class, and XML encryption is performed using the new EncryptedXml class.
Although XML encryption can be used to encrypt arbitrary data, you would most frequently use it to encrypt other XML. When used in this way, you have a lot of flexibility in how documents are encrypted. For instance, different nodes of an XML document could be encrypted with different keys, while some nodes are left in plain text. And since encrypting something with the EncryptedXml class results in XML, you can even encrypt the encrypted results, a process known as super encryption.
Let's take a look at some encrypted XML (see Figure 9). One interesting thing to note right away is that the XML Encryption standard uses the XML Signature namespace for some elements, including the KeyInfo element.

A simple document:
<docRoot>
  <a>Hello</a>
  <b>World</b>
</docRoot>
The document when encrypted:
<docRoot>
  <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
  xmlns="http://www.w3.org/2001/04/xmlenc#">
    <EncryptionMethod
    Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/> 
    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
      <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
        <EncryptionMethod
        Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> 
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <KeyName>recipient_public_key</KeyName> 
        </KeyInfo>
        <CipherData>
          <CipherValue>PrI6(3 lines of Base64 text)Dwy4=</CipherValue> 
        </CipherData>
      </EncryptedKey>
    </KeyInfo>
    <CipherData>
      <CipherValue>awcH(3 lines of Base64 text)NNqQ=</CipherValue> 
    </CipherData>
  </EncryptedData>
</docRoot>

EncryptedData Elements
EncryptedData is the root element generated by encrypting the XML, and it contains all the information about the data. EncryptedData contains three main subelements: EncryptionMethod specifies which algorithm was used to encrypt the data, KeyInfo element provides information about which key to use to decrypt the data, and the CipherData or CipherReference element contains the actual encrypted information. The EncryptionMethod element specifies the algorithm used to encrypt and decrypt the cipher data. The algorithms are specified by a URI, like the XML Signature standard. EncryptionMethod is used for both encrypted data and encrypted keys, but not every algorithm can be used in both places. Figure 10 shows where each algorithm can be used. Note that Advanced Encryption Standard (AES) is also available with 192- and 128-bit keys; you just change the key size in the URI.

  URI Properties of EncryptedXml Class Encrypting Data Encrypting Keys
AES XmlEncAES256Url  
XmlEncAES256KeyWrapUrl  
DES XmlEncDESUrl  
TripleDES XmlEncTripleDESUrl  
XmlEncTripleDESKeyWrapUrl  
RSA XmlEncRSA1_5Url  
Before any data can be encrypted or decrypted, the encryption engine needs to know which key should be used for encryption and decryption. Keys can be identified in two ways, the easiest of which is to assign the key a name and place a KeyName element within the KeyInfo element. The application decrypting the document will be responsible for taking the KeyName tag and providing the key that matches the name given.
Instead of providing only the key's name, a key can also be embedded directly into the KeyInfo element as an EncryptedKey. EncryptedKey contains the same elements as EncryptedData: the encryption method, the key used to decrypt this key, and the cipher data that makes up the encrypted key.
Encrypted keys are often used in combination with named keys as random session keys. First a random session key is generated and used to encrypt the XML. Then the session key is itself encrypted with a named key that is known by anyone who needs to decrypt the document. Finally, the named key would be inserted into the key info element of the encrypted session key, and the encrypted session key attached to the encrypted data. The sample in Figure 9 shows this. The encryption method for the XML data is 256-bit AES, and the key for the AES algorithm has been encrypted. The EncryptedKey element contains information about how the key for the AES algorithm was encrypted. In this sample, it was encrypted using an RSA key named recipients_public_key. The applications using XML Encryption would have to map this name to an actual key.
The actual encrypted data may either be embedded into the EncryptedData element or placed in a separate location and then referenced from EncryptedData. If the cipher data is to be placed directly into EncryptedData, it is placed in a CipherData element as Base64-encoded binary. The example shown in Figure 9 uses a CipherData element.
Another scenario involves placing the encrypted data outside the EncryptedData element. The cipher text might be placed anywhere from another element in the document to a remote Web site. In both cases, a CipherReference is used instead of a CipherData element (see Figure 11).

CipherReference Location URI Format Cipher Text Format
Same document #order Base64 string
Remote Web site http://www.example.com/order.bin Binary
CipherReferences to remote Web sites present an interesting security scenario. In the process of decrypting the XML, the decryption engine will have to go to an arbitrary Web site and download the cipher text. Since the document being decrypted may not be trusted as much as the code that's doing the decryption, this operation should be done in a sandbox. This is accomplished by providing evidence to the EncryptedXml object that it will use when resolving any CipherReferences.
Sandboxing allows for safer code execution since the decrypting application may not have the same permissions as the site that supplies the encrypted data. For instance, if an application attempts to decrypt an untrusted site, and the untrusted site does not have access to some trusted data on a secure, trusted site, it could cause the decrypting application to access that file for it by including a cipher reference.
Since the .NET security policy revolves around evidence, generally the evidence supplied should include at least Site, Zone, and Url objects, as shown here:
// Create evidence based on the referring document
Evidence evidence = new Evidence();
evidence.AddHost(new Zone(SecurityZone.Internet));
evidence.AddHost(new Site("untrustedsite"));
evidence.AddHost(new Url("untrustedsite/encrypted.xml"));

EncryptedXml exml = new EncryptedXml(untrustedDoc, evidence);

XML Encryption Example
Now let's look at how to use the classes in .NET Framework 2.0. This example shows a Web site that sells CDs. Each purchase is filed as an XML document that contains details on what was ordered, shipping information, and a credit card number. Figure 12 shows some sample XML for an order.
<order>
   <purchase>
     <item quantity="1">Def Leppard: Pyromania</item>
     <item quantity="1">Ozzy Osbourne: Goodbye to Romance</item>
   </purchase>
   <shipping>
     <to>Shawn Farkas</to>
     <street>One Microsoft Way</street>
     <zip>98052</zip>
   </shipping>
   <payment>
     <card type="visa">0000-0000-0000-0000</card>
   </payment>
</order>
In this instance, it is acceptable for anyone inside the company to see the items in the order, but you might want to secure some of the more sensitive data such as the shipping address and credit card information. In fact, you might even want to encrypt them separately, so that only the billing department has access to the credit card information, and only the shipping department has access to the shipping address.
To accomplish this, the portion of the XML under the payment element would be encrypted so that only the billing department has access to it. A separate key that is only available to the shipping department would be used to encrypt the shipping element. Finally, the entire order would be encrypted with a key available to anyone in the company.
The first step is to create an EncryptedXml object. This is done by passing in the document that has the data to be encrypted or decrypted, as shown here:
// Assumes the order is in the order.xml file.
XmlDocument doc = new XmlDocument();
doc.Load("order.xml");
EncryptedXml exml = new EncryptedXml(doc);
 
Before the XML can be encrypted, the keys to be used have to be mapped to their corresponding names. These are the names that will appear in KeyName elements. You use the AddKeyMapping method of the EncryptedXml for this:
// Set up the key mapping. Assumes a method called GetBillingKey
// that returns the RSA key for the billing department.
RSA billingKey = GetBillingKey();
exml.AddKeyNameMapping("billing", billingKey);
Once the key-to-name mapping is set up, encrypting the XML is easy. The first step is to call the Encrypt method, which does the actual encryption and returns an EncryptedData object representing the encrypted portion of the document. After that, you call a utility method to swap the unencrypted portion of the original XML document for the new encrypted data:
// Find the element to encrypt.
XmlElement paymentElement = 
  doc.SelectSingleNode("//order/payment") as XmlElement;
// Encrypt the payment element, passing in the key name.
EncryptedData encryptedPayment = 
  exml.Encrypt(paymentElement, "billing");
// Swap the encrypted element for the unencrypted element.
EncryptedXml.ReplaceElement(paymentElement, encryptedPayment, true);
This will result in the encrypted XML shown in Figure 13.
<order>
  <purchase>
    <item quantity="1">Def Leppard: Pyromania</item> 
    <item quantity="1">Ozzy Osbourne: Goodbye to Romance</item> 
  </purchase>
  <shipping>
    <to>Shawn Farkas</to> 
    <street>One Microsoft Way</street> 
    <zip>98052</zip> 
  </shipping>
    <payment>
      <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" 
           xmlns="http://www.w3.org/2001/04/xmlenc#">
        <EncryptionMethod Algorithm="http://www.w3.org/2001/04/
             xmlenc#aes256-cbc" />
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#">
            <EncryptionMethod Algorithm="http://www.w3.org/2001/04/
                 xmlenc#kw-aes256" />
            <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
              <KeyName>billing</KeyName>
            </KeyInfo>
            <CipherData>
              <CipherValue>Sce6lLD+u2f8HzPFyuGxTF32z4mb2ugql3JuJIPAqIP98iYs+Muhqg==
              </CipherValue>
            </CipherData>
          </EncryptedKey>
        </KeyInfo>
        <CipherData>
          <CipherValue>FXKC(3 lines of Base64 text)ApqQt</CipherValue>
        </CipherData>
      </EncryptedData>
    </payment>
</order>
Looking at the encrypted data, you can see the various parts that we've described. First, the EncryptionMethod element shows the URI for AES-256, meaning that the document was encrypted with the AES algorithm (as implemented by the RijndaelManaged class) with a 256-bit key.
The Encrypt method generates a random session key for you; this key is encrypted in the KeyInfo element. From looking at the EncryptedKey element you can see that it was encrypted with the RSA algorithm by a key named "billing." The CipherData element holds the encrypted value of the key. Following the KeyInfo is the CipherData that contains the encrypted contents of what used to be the payment element.
Decrypting the document just shown is easy, thanks to the DecryptDocument method of EncryptedXml. First, you load the document with encrypted content:
// Assumes the encrypted order is in encrypted.xml
XmlDocument doc = new XmlDocument("encrypted.xml");
EncryptedXml exml = new EncryptedXml(doc, documentEvidence);
Next, you set up the key name mappings, like this:
// Set up the key mapping. Assumes a method called GetBillingKey
// that returns the RSA key for the billing department.
RSA billingKey = GetBillingKey();
exml.AddKeyNameMapping("billing", billingKey);
Finally, you call DecryptDocument. This method will take care of decrypting the cipher text and replacing the encrypted XML with its decrypted contents.
// Decrypt the encrypted XML in the document
exml.DecryptDocument();
Behind the scenes, the encryption engine will look for any EncryptedData elements when DecryptDocument is called. In this case, it finds only the one below the payment element. Once it finds this element, it will look at the KeyInfo clause and see that it holds an encrypted 256-bit AES key. The KeyInfo for the encrypted key will show that it was encrypted with an RSA key named billing. It then checks the key mapping table for a key named billing. We added a key mapping for a key named billing, so the engine then decrypts the encrypted key. Now that it has the key, the engine decrypts the CipherData. The results of the decrypted CipherData are then swapped for the EncryptedData element. The engine will follow this process for each EncryptedData element it finds in the document when DecryptDocument is called.

X.509 Support
One of the challenges in security is trust. Securely distributing and storing trusted public keys on a network is not easy. Windows® provides lots of infrastructure for solving this problem, however. The Cryptographic API (CAPI) provides support for distributing, manipulating, and storing X.509 certificates. The support that CAPI provides is also known as Public Key Infrastructure (PKI).
An X.509 certificate provides additional information about a key. Certificates specify who issued the key, to whom the key was issued, and when the certificate is valid, along with the actual key information. Certificates are issued by Certificate Authorities (CAs). A CA is an entity (an external company or your company's IT department, for example) that you trust to vouch for the identity of a certificate holder. If you have a valid certificate containing your billing department's public key that is issued by a CA you trust, you can be sure the public key is really the billing department's.
The Windows PKI support allows you to securely store certificates in a certificate store on a computer, add and remove certificates in certificate stores on machines across the network, add and remove trusted CAs on machines across the network, and obtain and verify information about individual certificates, among other things. This allows you, for example, to distribute the certificate containing the public key for your company's billing department to all the computers on your company's network. In the .NET Framework 1.x, you had to call unmanaged APIs to take advantage of most of this support. In the .NET Framework 2.0, most of these APIs are available in managed code, via the X509CertificateEx class and related classes. The XML Signature classes support the X509CertificateEx class directly.
To create an XML signature with a certificate, you simply get the private key from the certificate's PrivateKey property and use it for the SignedXml object's signing key.
// Use the private key from the certificate. Assumes a SignedXml
// object in sig and an X509CertificateEx object in cert.
sig.SigningKey = cert.PrivateKey;
Of course, the certificate must have a private key associated with it, or the PrivateKey property returns null.
You can also add the X.509 certificate information to the KeyInfo element of the signature by using the KeyInfoX509Data class, as shown in the following code:
// Add X.509 certificate info to the KeyInfo element. Assumes a
// SignedXml object in sig and an X509CertificateEx in cert.
KeyInfoX509Data keyInfoX509 = 
  new KeyInfoX509Data(cert, X509IncludeOption.EndCertOnly);
sig.KeyInfo.AddClause(keyInfoX509);
To verify an XML signature signed with a certificate's private key, you can call a new overload of the CheckSignature method of the SignedXml class. This new overload takes an X509CertificateEx object and a Boolean. If the Boolean is set to true, the method will verify the signature against the public key in the certificate and verify the certificate by checking key usage and building a chain to a trusted root issuer.
// Check the signature against the cert and verify the cert. Assumes a
// SignedXml object in sig and an X509CertificateEx object in cert.
bool verified = sig.CheckSignature(cert, true);
You can also use the CheckSignature method that takes no parameters to verify a signature, but it will not also verify an X.509 certificate if one was used to sign the XML. You would have to recreate the X509CertificateEx object from the KeyInfo and verify it as a separate step.
For more information about creating X.509 certificates for testing purposes, see the Certificate Creation Tool (Makecert.exe) topic in the .NET Framework SDK documentation.
The .NET Framework 2.0 adds a few new transforms and canonicalization algorithms to the signature engine. These include the Exclusive C14N canonicalization algorithm, XML Decryption transform, and the LTA transform. Figure 14 contains a complete table of the transforms and canonicalization algorithms available in the .NET Framework 2.0 signature engine.

Class Description
XmlDecryptionTransform Decrypts encrypted XML
XmlDsigBase64Transform Decodes base64 encoded data
XmlDsigC14NTransform Performs C14N canonicalization (see http://www.w3.org/TR/xml-c14n for more information)
XmlDsigEnvelopedSignatureTransform Removes an enveloped signature from a document
XmlDsigExcC14NTransform Performs exclusive C14N canonicalization (see http://www.w3.org/TR/2002/REC-xml-exc-c14n-20020718 for more information)
XmlDsigXPathTransform Applies an XPath filter to the input XML
XmlDsigXsltTransform Applies an XSLT transform to the input XML
XmlLicenseTransform Implements the LTA transform
XmlDsigC14NWithCommentsTransform Performs C14N canonicalization, but leaves comments in the canonicalized XML
XmlDsigExcC14NWithCommentsTransform Performs exclusive C14N canonicalization, but leaves comments in the canonicalized XML

Conclusion
We've discussed the basics of the XML Signature standard and how it is implemented in the .NET Framework 1.x. We've also covered some new features in the .NET Framework 2.0, including support for the XML Encryption standard and X.509 certificate integration for XML signing. These building-block technologies allow you to interoperate with other applications using the standards and build standards support into your own applications.

1 comments