title: XML Signature Reference digest uses parent namespace
body: <p>I need to sign an XML-File in Java, which needs to contain 3 <code>Reference</code>s.<br>
  While 2 of them are valid (expected digest == actual digest), one is invalid.<br>
  The relevant part of the XML Looks like:  </p>
  
  <pre><code>&lt;QualifyingProperties xmlns="http://uri.etsi.org/01903/v1.3.2#" Target="Signature1"&gt;
      &lt;SignedProperties Id="SignedProperties_1"&gt;
          &lt;SignedSignatureProperties&gt;
              &lt;SigningTime&gt;2014-11-27T13:49:36&lt;/SigningTime&gt;
          &lt;/SignedSignatureProperties&gt;
      &lt;/SignedProperties&gt;
  &lt;/QualifyingProperties&gt;
  </code></pre>
  
  <p>The <code>Reference</code> only references the <code>Element</code> "SignedProperties" and its children.<br>
  As you can see the "QualifyingProperties" <code>Element</code> defines a namespace (<code>xmlns="http://uri.etsi.org/01903/v1.3.2#"</code>) and i guess thats the problem:</p>
  
  <p>After having a look at the log i found, that the "Pre-Digest" Value looks like:  </p>
  
  <pre><code>&lt;SignedProperties xmlns="http://uri.etsi.org/01903/v1.3.2#" Id="SignedProperties_1"&gt;
      &lt;SignedSignatureProperties&gt;
          &lt;SigningTime&gt;2014-11-27T13:49:36&lt;/SigningTime&gt;
      &lt;/SignedSignatureProperties&gt;
  &lt;/SignedProperties&gt;
  </code></pre>
  
  <p>While the "SignedProperties" <code>Element</code> in the real file does not contain the namespace, but its parent does.<br>
  I found out, that the actual digest matches the SHA-256 of the "Pre-Digest" value, while the expected digest matches the SHA-256 of the real file (without the namespace).  </p>
  
  <p>The <code>Reference</code> is created with the following code:</p>
  
  <pre><code>Reference sigPropRef = fac.newReference("#SignedProperties_1", fac.newDigestMethod(DigestMethod.SHA256, null),
      Collections.singletonList(sigPropTransform), "http://uri.etsi.org/01903#SignedProperties", "reference-signedpropeties"
  );
  </code></pre>
  
  <p>Where the <code>sigPropTransform</code> is a <code>CanonicalizationMethod.EXCLUSIVE</code> <code>Transform</code>.</p>
  
  <p>My question is, how can i solve the problem, i.e. how can i prevent the namespace to be added to the "SignedProperties" <code>Element</code>, before calculating the digest?</p>
  
  <p>If you need any other informations please leave a comment, i am pretty new to this theme, so i am not sure which informations are relevant and which not.<br>
  Thanks a lot!</p>
  
  <p><strong>EDIT:</strong> After playing arround a bit, it seems to me, that the "actual digest" is the digest, the validator calculated, while the "expected digest" is the digest inside the "DigestValue" <code>Element</code>.<br>
  That means, that the digest value inside my file matches the SHA-256 of the referenced filepart, but the validator for some reason calculates the digest WITh the parents namespace.<br>
  So i guess what i need is to include the parents namespace in my digest calculation.</p>
  
  <p><strong>EDIT:</strong> I continued playing arround and now i have not only the Pre-Digest value of the validator but also the one of my "digest calculation".<br>
  That one gives me:  </p>
  
  <pre><code>&lt;SignedProperties Id="SignedProperties_1"&gt;&lt;SignedSignatureProperties&gt;&lt;SigningTime&gt;2014-11-27T15:51:26&lt;/SigningTime&gt;&lt;/SignedSignatureProperties&gt;&lt;/SignedProperties&gt;  
  </code></pre>
  
  <p>when i give it the following <code>Transform</code>:  </p>
  
  <pre><code>Transform sigPropTransform = fac.newTransform(CanonicalizationMethod.EXCLUSIVE, (ExcC14NParameterSpec)null);  
  </code></pre>
  
  <p>And:  </p>
  
  <pre><code>&lt;SignedProperties xmlns:ds="some-url" xmlns:msg="some-other-url" Id="SignedProperties_1"&gt;&lt;SignedSignatureProperties&gt;&lt;SigningTime&gt;2014-11-27T15:52:49&lt;/SigningTime&gt;&lt;/SignedSignatureProperties&gt;&lt;/SignedProperties&gt;
  </code></pre>
  
  <p>when i don't give it any <code>Transform</code>.<br>
  The namespace <code>xmlns="http://uri.etsi.org/01903/v1.3.2#"</code> is never included.</p>
  
  <p>How do i include it?</p>