Secure XML: The New Syntax for Signatures and Encryption

16.2. The Decryption Transform

The Decryption Transform makes it easier to verify XML signatures over data when some of the data has been encrypted before and some after the signature was applied. The signature verifier needs to know which parts to decrypt and which parts to leave encrypted when trying to verify the signature. (This section is based on a W3C Working Draft [Decrypt] but subsequent recommendations will likely have similar characteristics and limitations.)

16.2.1. Introduction to the Decryption Transform

The Decryption Transform works as follows: A Transform is added to appropriate Reference elements in a SignedInfo or Manifest element (see Chapter 10). The Transform takes a list of encrypted parts of the data as parameters. When ...