lib-cl-sii-python icon indicating copy to clipboard operation
lib-cl-sii-python copied to clipboard

rtc: Signature verification fails for XMLs that are not in their canonical form

Open ycouce-cdd opened this issue 3 years ago • 0 comments

Even though it is assumed that a canonicalization algorithm is applied before performing the digital signature calculations of the XML, even if it is referenced in the SignedInfo element, it does not mean that it was necessarily applied. Unfortunately, the SII does not verify that the XML is in its canonical form, so it is common that several of the AECs accepted by the SII are not normalized (See discussion at https://github.com/fyntex/lib-cl-sii-python/pull/242). For this reason, the signature verification algorithm will fail in those XMLs that, by canonicalizing them before verifying their signature, the normalization introduces changes that modify the content of the XML, e.g. documents containing empty-element tags

ycouce-cdd avatar Oct 14 '21 16:10 ycouce-cdd