Additional XML Security Uniform Resource Identifiers (URIs)
obsoleted by
- rfc-9231 — Additional XML Security Uniform Resource Identifiers (URIs)
obsoletes
- rfc-4051 — Additional XML Security Uniform Resource Identifiers (URIs)
Extracted elements (26)
Minimal Canonicalization was dropped from XML Digital Signature when advancing from RFC 3075 to RFC 3275 because two independent interoperable implementations had not been demonstrated. The URI 'http://www.w3.org/2000/09/xmldsig#minimal' is retained here to preserve the original namespace despite continued interest.
RSA-SHA384 and RSA-SHA224 are included for completeness but the document notes that SHA-384 requires about the same computation as SHA-512, and SHA-224 as SHA-256; therefore RSA-SHA512 is suggested over RSA-SHA384, and RSA-SHA256 over RSA-SHA224, wherever possible.
Specification of a URI representing an algorithm in this document does not imply endorsement of that algorithm for any particular purpose. A protocol specification (which this RFC is not) is responsible for defining algorithm requirements and implementation mandates for specific use cases.
Three URI namespace prefixes are used for historical reasons: 'http://www.w3.org/2000/09/xmldsig#' for original XMLDSIG algorithms, 'http://www.w3.org/2001/04/xmldsig-more#' for algorithms added by RFC 4051 (now frozen), and 'http://www.w3.org/2007/05/xmldsig-more#' for algorithms newly added by this document. The 2001 namespace was frozen with RFC 4051's publication per W3C namespace stability rules.
No additional 'http://www.w3.org/2007/05/xmldsig-more#' URIs are intended to be created beyond those enumerated in this RFC. The '2001/04/xmldsig-more#' namespace was frozen with RFC 4051's publication; the '2000/09/xmldsig#' namespace is prohibited from new URIs by W3C namespace stability rules.
For RSA-MD5 signatures, the FF octet in the PKCS#1 v1.5 padding MUST be repeated enough times that the value being encrypted is exactly one octet shorter than the RSA modulus. The padded structure is: 01 | FF* | 00 | prefix | hash.
For RSASSA-PSS SignatureMethod identifiers, the default salt length if SaltLength is not specified SHALL be the number of octets in the hash value of the digest method, as recommended in RFC 4055. SHA-256 is the default digest if none is specified (overriding RFC 3447's SHA-1 default due to SHA-1 weakness).
Additional RetrievalMethod Type attribute values are defined for raw and structured key information: KeyName, KeyValue, PKCS7signedData, rawPGPKeyPacket, rawPKCS7signedData, rawSPKISexp, rawX509CRL, and RetrievalMethod. 'Raw' types require the Type attribute because they are binary and not unambiguously parsable.
ARCFOUR (RC4-compatible) stream encryption is identified by 'xmldsig-more#arcfour' as an EncryptionMethod. It uses the generic KeySize parameter from XML Encryption 1.1 to specify key length in bits.
Camellia block encryption is supported in three key sizes via 'xmldsig-more#camellia128-cbc', '#camellia192-cbc', and '#camellia256-cbc'. It uses 128-bit block size, CBC mode with a 128-bit IV prepended to the ciphertext, then base64-encoded — identical to AES usage in XML Encryption.
Camellia key wrap algorithms ('xmldsig-more#kw-camellia128/192/256') are identical to AES key wrap (RFC 3394) with 'AES' replaced by 'Camellia'. The check value is 0xA6A6A6A6A6A6A6A6. Wrapping 128-bit keys with 128-bit KEK and 256-bit keys with 256-bit KEK is particularly suggested.
ECDSA signature algorithms are identified for ECDSA-SHA1/224/256/384/512 under '2001/04/xmldsig-more#' and ECDSA-RIPEMD160, ECDSA-Whirlpool under '2007/05/xmldsig-more#'. The signature value is the base64 encoding of the concatenation of the I2OSP-encoded integers r and s, each padded to the byte length of the curve's base point order.
HMAC SignatureMethod algorithms are defined for HMAC-MD5 ('xmldsig-more#hmac-md5'), HMAC-SHA224/256/384/512, and HMAC-RIPEMD160. The HMAC algorithm takes an optional truncation length in bits as HMACOutputLength; if omitted, all hash bits are output.
MD5 DigestMethod algorithm is identified by URI 'http://www.w3.org/2001/04/xmldsig-more#md5'. An MD5 digest is a 128-bit string; the DigestValue element SHALL contain the base64 encoding of this value viewed as a 16-octet stream.
PKCS #7 signedData structures can be embedded in KeyInfo as a bag of certificates and/or CRLs using the PKCS7signedData element ('xmldsig-more#PKCS7signedData'). The binary PKCS #7 structure is base64-encoded; any signer information present is ignored.
RSA public-key signature algorithms are defined using PKCS#1 v1.5 (RSASSA-PKCS1-v1_5) padding: RSA-MD5, RSA-SHA256, RSA-SHA384, RSA-SHA512, RSA-RIPEMD160, and RSA-SHA224. The SignatureValue is the base64 encoding of the RSASSA-PKCS1-v1_5 signature output with the appropriate ASN.1 BER algorithm OID prefix embedded.
RSASSA-PSS with parameters is identified by 'xmldsig-more#rsa-pss' and 'xmldsig-more#MGF1'. It takes DigestMethod, MaskGenerationFunction, SaltLength, and TrailerField as explicit XML parameters via the RSAPSSParams schema element in the SignatureMethod content.
RSASSA-PSS without parameters provides fixed-parameter variants combining hash and MGF1 in a single URI (e.g., 'sha256-rsa-MGF1', 'sha3-256-rsa-MGF1', 'whirlpool-rsa-MGF1'). Fourteen such identifiers are defined; all use the same hash function for both digest and MGF1, trailer field 0xBC, and salt length equal to hash output length.
SEED block encryption ('xmldsig-more#seed128-cbc') is a 128-bit block cipher with 128-bit keys used in CBC mode with a 128-bit IV prepended and result base64-encoded. SEED key wrap ('xmldsig-more#kw-seed128') follows RFC 3394 Section 2.2.1 with 'AES' replaced by 'SEED'; implementation is optional.
SHA-224 (URI: 'xmldsig-more#sha224') and SHA-384 (URI: 'xmldsig-more#sha384') DigestMethod algorithms produce 224-bit (28-octet) and 384-bit (48-octet) digests respectively, with DigestValue base64-encoded. Both take no explicit parameters per FIPS 180-4.
SHA-3 (Keccak-f[1600]) placeholder URIs are reserved for sha3-224, sha3-256, sha3-384, and sha3-512 under the '2007/05/xmldsig-more#' namespace. DigestValue SHALL be base64 encoding of the 28-, 32-, 48-, or 64-octet digest stream respectively.
Whirlpool hash algorithm is identified by URI 'http://www.w3.org/2007/05/xmldsig-more#whirlpool'. It produces a 512-bit digest encoded as a 64-octet base64 stream in DigestValue. Defined in ISO/IEC 10118-3.
IANA established a registry entitled 'XML Security URIs' with initial contents corresponding to the URI index in Section 4.2 of this document. New entries are added based on Expert Review, requiring documentation sufficient for interoperability and inclusion in an approved W3C or IETF Standards Track document.
Cryptographic algorithms become weaker over time as cryptanalysis techniques improve and computing performance increases. Implementations SHOULD be modular to allow new algorithms to be readily inserted, as the set of mandatory-to-implement algorithms will change over time.
RFC 6151 MUST be consulted before using MD5 as a DigestMethod or RSA-MD5 as a SignatureMethod. SHA-1 security considerations are in RFC 6194 and MD5 considerations in RFC 6151. For RSASSA-PSS, SHA-256 or stronger is recommended due to the discovered weakness of SHA-1.
ECDSA SignatureValue encodes the (r, s) integer pair by concatenating their I2OSP octet-stream representations, each of length equal to the base point order size in bytes (e.g., 32 bytes for P-256, 66 bytes for P-521), then base64-encoding the result.