J2EE™ Security for Servlets, EJBs and Web Services: Applying Theory and Standards to Practice

XML Signature and Encryption Combinations

An electronic signature achieves two results: it guarantees that the message has not been modified after being signed and that it originated from the claimed signer. It is possible, and may even be a requirement for some applications, that multiple entities sign the same message. As a practical example, think of a legal agreement being signed by two parties. As XML Signature allows the Signature element itself to be detached from the signed data and signed data itself could consist of multiple data items, it is perfectly valid to create multiple Signature elements, each over the same set of data items and corresponding to a different signer. In fact, there is also the possibility of a signature itself ...