WebRef   Sitemap · Experts · Tools · Services · Newsletters · About

Safer XML

Technical Lead Thomson Reuters (Markets) LLC US-NY-New York Post A Job | Post A Resume

Developer News Microsoft Shows Off Silverlight 4, IE9 Plans Metasploit Expands Vulnerability Test Framework HyperCard Reborn?

Examples

We conclude with examples of XML Encryption and XML Signature. Here is an example of confidential credit card data that should be protected:

<creditcard>
  <holder>Michael Classen</holder>
  <data>
    <type>Eurocard/Mastercard</type>
    <number>4444 3333 2222 1111</number>
    <issuer>Deutsche Bank</issuer>
    <expires>12/02</expires>
  </data>
</creditcard>

Encryption

Encryption can be applied selectively, so here is the encrypted version of the credit card number only:

<creditcard>
  <holder>Michael Classen</holder>
  <data>
    <type>Eurocard/Mastercard</type>
    <number>
      <enc:encrypteddata type="http://www.w3.org/2001/04/xmlenc#Content"
        xmlns:enc="http://www.w3.org/2001/04/xmlenc#">
        <enc:cipherdata><enc:ciphervalue>ABCD...4711</enc:ciphervalue></enc:cipherdata>
      </enc:encrypteddata>
    </number>
    <issuer>Deutsche Bank</issuer>
    <expires>12/02</expires>
  </data>
</creditcard>

Encrypting the complete credit card data except the name:

<creditcard>
  <holder>Michael Classen</holder>
  <enc:encrypteddata type="http://www.w3.org/2001/04/xmlenc#Element"
    xmlns:enc="http://www.w3.org/2001/04/xmlenc#">
    <enc:cipherdata><enc:ciphervalue>A7C1...4B1D</enc:ciphervalue></enc:cipherdata>
  </enc:encrypteddata>
</creditcard>

Encryption of everything looks like this:

<enc:encrypteddata type="http://www.isi.edu/in-notes/iana/assignments/media-types/text/xml"
  xmlns:enc="http://www.w3.org/2001/04/xmlenc#">
  <enc:cipherdata><enc:ciphervalue>4B1D...A7C1</enc:ciphervalue></enc:cipherdata>
</enc:encrypteddata>

Signature

Signing the credit card info:

<sig:signature xmlns:sig="http://www.w3.org/2000/09/xmldsig#">
  <signedinfo>
    <sig:reference uri="#cc" />
  </sig:signedinfo>
  <sig:signaturevalue>4711...ABCD</sig:signaturevalue>
  <sig:object>
    <creditcard id="cc">
      <holder>Michael Classen</holder>
      <data>
        <type>Eurocard/Mastercard</type>
        <number>4444 3333 2222 1111</number>
        <issuer>Deutsche Bank</issuer>
        <expires>12/02</expires>
      </data>
    </creditcard>
  </sig:object>
</sig:signature>

Conclusion

A fair number of XML security standards strive for making the XML world as safe a place as the rest of computing has been in the past. While the implementations of these specifications are still in their early days, there is no doubt that the existing security measures can be adapted and carried forward to the XML world.

Produced by Michael Claßen

Search:

WebMediaBrands Corporate Info

Legal Notices, Licensing, Permissions, Privacy Policy.
Advertise | Newsletters | Shopping | E-mail Offers | Freelance Jobs

Solutions

Whitepapers and eBooks

Microsoft Articles: Visual Studio 2010 Adobe Article: Adobe Helps PHP Developers Create Rich Internet Applications Microsoft Whitepaper: How Windows Server 2008 R2 Helps Optimize IT and Save You Money Adobe Article: Java Developers Finding a Home at Adobe Flex IBM Articles: A Smarter Business Needs Smarter Technology Intel Xeon Processor Increases Server Efficiency and Capabilities Intel Tech Brief: Automated Energy Efficiency for the Intelligent Enterprise Oracle Whitepapers - Innovation for IT Leaders Avaya Article: Communication-Enabled Mashups--Empowering Both Business Owners and IT

Internet.com eBook: IT Manager's Guide to Social Networking Internet.com eBook: Get Ready for Windows 7 Microsoft Article: Expression Web 3--New Features for PHP Developers Whitepapers: Manage Your Business Infrastracture with IBM Whitepaper: Maximize Your Storage Investment with HP Internet.com eBook: Becoming a Better Project Manager Microsoft Article: Stress Free and Efficient Designer/Developer Collaboration MORE WHITEPAPERS, EBOOKS, AND ARTICLES

Webcasts

Webcast: Connecting PHP to Microsoft Technologies Video: Microsoft Partner Program Benefits Video: Windows Azure Debugging Tips SAP BusinessObjects Webcast: Unlock the Power of Reporting with Crystal Reports

IBM Webcast: Speed Business Innovation with Reduced Cost and Risk Video: Deploy Applications on Windows Azure MORE WEBCASTS, PODCASTS, AND VIDEOS

Downloads and eKits

Download: Microsoft Visual Studio 2010 Beta 2 Downloads & Free Trials: Microsoft's New Efficiency Resource Center Get the Windows 7 SDK

Free Trial: Red Gate SQL Backup Pro 6 Iron Speed Designer Application Generator MORE DOWNLOADS, EKITS, AND FREE TRIALS

Tutorials and Demos

Internet.com Hot List: Get the Inside Scoop on the Hottest IT and Developer Products All About Botnets

MORE TUTORIALS, DEMOS AND STEP-BY-STEP GUIDES

The latest from WebReference.com Browse > Site Contents - - - - - Experts * 3D Animation * Design * DHTML * Graphics * HTML * JavaScript * Perl * XML - - - - - Web Resources * Authoring * Design * Internet * Multimedia * Programming * Promotion - - - - - Services * Interviews * Newsletters * Reviews * Search * Tools Rolling Out Your Own HTML Application Version Control · HTML 5: Client-side Storage · Working with Ajax Server Extensions Sitemap · Experts · Tools · Services · Email a Colleague · Contact FREE Newsletters >   The latest from internet.com Wi-Fi Product Watch, November 2009 · Chip Market Recovering From '08 Collapse · Low-Cost Tools to Kickstart Your New Business

URL: http://www.webreference.com/xml/column72/2.html
Created: Jan 06, 2003
Revised: Jan 06, 2003