title: Calculating SignatureValue from SignedInfo
body: <p>I am currently trying to follow <a href="http://www.di-mgt.com.au/xmldsig2.html" rel="nofollow">this tutorial</a> on "Signing an XML Document". So far I have been able to run the c14n algorithm and calculate the appropriate <code>DigestValue</code>.</p>
  
  <p>However, I cannot seem to get the correct value for the <code>SignatureValue</code> field. I am currently calculating the digest value for the <code>SignedInfo</code> tag correctly as it matches the author's calculation but the problem that I cannot seem to solve is that signing the hash results in a different string that the expected one.</p>
  
  <p>My current script looks like this:</p>
  
  <pre><code>&lt;?php
  $c14n = '&lt;SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
        &lt;CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"&gt;&lt;/CanonicalizationMethod&gt;
        &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"&gt;&lt;/SignatureMethod&gt;
        &lt;Reference URI=""&gt;
          &lt;Transforms&gt;
            &lt;Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"&gt;&lt;/Transform&gt;
          &lt;/Transforms&gt;
          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/DigestMethod&gt;
          &lt;DigestValue&gt;UWuYTYug10J1k5hKfonxthgrAR8=&lt;/DigestValue&gt;
        &lt;/Reference&gt;
      &lt;/SignedInfo&gt;';
  
  echo sha1($c14n).PHP_EOL.PHP_EOL; // a25a06d339d68b625cd7383a932357889956a54e OK !!
  
  $data = sha1($c14n); // sha1($c14n,true) wont work either
  
  $pkeyid = openssl_pkey_get_private("file://key.txt",'password'); // PK
  
  // compute signature
  openssl_sign($data, $signature, $pkeyid);
  
  // free the key from memory
  openssl_free_key($pkeyid);
  
  // Result should be: TSQUoVrQ0kg1eiltNwIhKPr ...
  echo base64_encode($signature); // Wont match!
  ?&gt;
  </code></pre>
  
  <p>I am not sure whether the raw version or the hex one should be signed. Either way, the values obtained do not match, so there must be something else. I used <code>openssl</code> and came up with another different result, so I am very confused.</p>
  
  <pre><code>$ cat signedinfo.txt 
  &lt;SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
        &lt;CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"&gt;&lt;/CanonicalizationMethod&gt;
        &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"&gt;&lt;/SignatureMethod&gt;
        &lt;Reference URI=""&gt;
          &lt;Transforms&gt;
            &lt;Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"&gt;&lt;/Transform&gt;
          &lt;/Transforms&gt;
          &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"&gt;&lt;/DigestMethod&gt;
          &lt;DigestValue&gt;UWuYTYug10J1k5hKfonxthgrAR8=&lt;/DigestValue&gt;
        &lt;/Reference&gt;
      &lt;/SignedInfo&gt;
  $ openssl dgst -sha1 -sign key.txt -out sign-ID.bin signedinfo.txt
  $ php -r 'echo base64_encode(file_get_contents("sign-ID.bin"));'
  bFGI6KjCXtu1mAPFzvfyPkhZU5/CsYIR2IIQ0/n+6zZYqVAuIqjtgrc+xQXOQhf5RTcVR2zr/teWSSjmQvaHzFn4NhXGxvEMng1Kqg04XpQS41OLgAjaNMRW5iU4cRwFW1VMPAiHkjZggDkDgG8pSn6zdQh0yUEgo+86zJI6kbQ=
  </code></pre>
  
  <p>I have been able to check that openssl generates a diferent digest than the expected (a25a06d339d68b625cd7383a932357889956a54e) if run from the terminal. I have double checked, triple checked and made sure that the file contents where exactly like the <code>$c14n</code> variable.</p>
  
  <p>What exactly am I doing wrong?</p>
  
  <p><strong>Notes:</strong>
  I did check the XML that the author provided on <a href="https://www.aleksey.com/xmlsec/xmldsig-verifier.html" rel="nofollow">this website</a> and it seems to be okay. The <a href="http://www.di-mgt.com.au/AlicePrivRSASign_epk.txt" rel="nofollow">private key used</a> is the same as the one on the How-To.</p>