digest do not match

[RazaGR]

I get error The digest of soapBody was not correct.

any idea @adamdecaf why it could happen?

	signer, err := signedxml.NewSigner(xmlString)
	signedXML, err := signer.Sign(privateKey)

</Reference>
  <Reference URI="#soapBody">
    <Transforms>
      <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    </Transforms>
    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <DigestValue>TLcN2ydc2+DlKl5IEzl1PDHTf4E=</DigestValue>
  </Reference>

[adamdecaf]

Is there more to the Signature element? Can you compare the output to another library? We know the library doesn't fully support all transforms and c14n specifications.

[RazaGR]

here is full xml https://pastecode.io/s/33vn08oc
I am using xmlsec1 to verify and have used xmlsec1 which creates a valid digest values

xmlsec1 --sign --output original.xml --privkey-pem private.key,name.crt  signed.xml

could you please recommend which other library? Thanks

[adamdecaf]

I can't see that paste. Is xmlsec1 transforming the xml differently than this library? My assumption is the issue comes from moov-io/signedxml missing some of the c14n logic.

[RazaGR]

DigestValue is different with xmlsec1
paste https://pastecode.io/s/wjet5d6h

[nejcgorsic]

This seems like it has the same issue and not resolved, as #47?

[printesoi]

I still get this error with signedxml v1.2.1. The following XML file with signature was generated with xmlsec1, I can sucessfully verify it with xmlsec1 --verify --insecure test.xml and with https://tools.chilkat.io/xmlDsigVerify.cshtml , but when using:

validator, _ := signedxml.NewValidator(xmlData)
xmlv, err := validator.ValidateReferences()

I get Calculated digest does not match the expected digestvalue of R66/Sid+tFYdFog0cjhSiagTnTZLN6Njs/Y7YZtH1mc=

[adamdecaf]

I get the same error with your fork of github.com/m29h/xml but those libraries are improving marshaling. I tried reading and writing using your fork without much luck.

[leifj]

I am getting the same error (not sure if its the same issue though) on https://trustedlist.pts.se/SE-TL.xml which I am reasonably sure is correct. The error changed when I set the reference ID attribute to "Id" so it may be related to reference processing...

[leifj]

In my case it appears related to the hash of the XaDES signature over the SignedProperties element...

[leifj]

I am pretty sure that the problem is that the doc (ie the hash buffer) doesn't include namespace declarations which throws off the hash calculations. I ratholed on this when working on pyXMLSecurity too years ago :-)

(edited)

The problem seems quite hard to fix given that etree doesn't even include namespaces when you try to serialize an etree.Element using WriteTo. The only approach may be to traverse the tree from the Reference element, adding all xmlns declarations that are missing.

[leifj]

I may have a solution. Will provide a PR presently.

(edited) my solution is the same idea as in #41 but in addition to that you have to swith the order of processing and do c14n after reference processing because fundamentally etree doesn't handle namespaces correctly during copy etc