title: XMLDSig: Do I have to specify Reference URI in an enveloped signature
body: <p>Suppose I have such xml: </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CATALOG&gt;
      &lt;CD&gt;
          &lt;TITLE&gt;Empire Burlesque&lt;/TITLE&gt;                    
          &lt;ARTIST&gt;Bob Dylan&lt;/ARTIST&gt;
          &lt;COUNTRY id="123"&gt;USA&lt;/COUNTRY&gt;
          &lt;COMPANY&gt;Columbia&lt;/COMPANY&gt;
          &lt;PRICE&gt;10.90&lt;/PRICE&gt;
          &lt;YEAR&gt;1985&lt;/YEAR&gt;
      &lt;/CD&gt;    
      &lt;CD&gt;
          &lt;TITLE&gt;Hide your heart&lt;/TITLE&gt;
          &lt;ARTIST&gt;Bonnie Tyler&lt;/ARTIST&gt;
          &lt;COUNTRY&gt;UK&lt;/COUNTRY&gt;
          &lt;COMPANY&gt;CBS Records&lt;/COMPANY&gt;
          &lt;PRICE&gt;9.90&lt;/PRICE&gt;
          &lt;YEAR&gt;1988&lt;/YEAR&gt;
      &lt;/CD&gt;
      &lt;CD&gt;
          &lt;TITLE&gt;Greatest Hits&lt;/TITLE&gt;
          &lt;ARTIST&gt;Dolly Parton&lt;/ARTIST&gt;
          &lt;COUNTRY&gt;USA&lt;/COUNTRY&gt;
          &lt;COMPANY&gt;RCA&lt;/COMPANY&gt;
          &lt;PRICE&gt;9.90&lt;/PRICE&gt;
          &lt;YEAR&gt;1982&lt;/YEAR&gt;
      &lt;/CD&gt;   
  &lt;/CATALOG&gt;
  </code></pre>
  
  <p>After signing I get:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CATALOG&gt;
      &lt;CD&gt;
          &lt;TITLE&gt;Empire Burlesque&lt;/TITLE&gt;                    
          &lt;ARTIST&gt;Bob Dylan&lt;/ARTIST&gt;
          &lt;COUNTRY id="123"&gt;USA&lt;/COUNTRY&gt;
          &lt;COMPANY&gt;Columbia&lt;/COMPANY&gt;
          &lt;PRICE&gt;10.90&lt;/PRICE&gt;
          &lt;YEAR&gt;1985&lt;/YEAR&gt;
          &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:SignedInfo&gt;
                  &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
                  &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-md5"/&gt;
                  &lt;ds:Reference URI=""&gt;
                      &lt;ds:Transforms&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                          &lt;ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
                      &lt;/ds:Transforms&gt;
                      &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#md5"/&gt;
                      &lt;ds:DigestValue&gt;C6i9GSNZ8seoXxfuFc482Q==&lt;/ds:DigestValue&gt;
                  &lt;/ds:Reference&gt;
              &lt;/ds:SignedInfo&gt;
              &lt;ds:SignatureValue&gt;
  d/ufAnYK35PKUdi+O6DUytV+36OGAr5meHXq2qoOUp+zO1Q5HbJvIs01qlPT9oKiBEi2QiAF3Sya
  ZVwi4hEI9xHkLiewmOxPo1KgVfJ1Ir2RPpkdegFYFx9QCMR4Z1M7zTkijCKv9ncWR4MYjOAfDrKf
  fbvUX3AbRHlUYJj6M4QcrQUuBPhSqo4TcxtfblNqmKUT+141+sLSsuM2xy24YeyF7NUff9tirCiP
  KgBHpFGtiJAdxugAlzqHaR9CP2kRA2Sg046NBo2yO/nTDfUKqquZm4aaZsLWbvKJYvrgqD4YgH4M
  FFpK5ChgYa4oi7f9BAYxOFcY9f1OCHsvpdCbpw==
              &lt;/ds:SignatureValue&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:KeyValue&gt;
                      &lt;ds:RSAKeyValue&gt;
                          &lt;ds:Modulus&gt;
  1Bphf/ypmjIyIbWKBS39IaBpUn/e7oylpexMhTtsKYnbKuufzDhReR15oJ9cavVa9BkSSmLjaLxt
  jIzIswaoW0SnTR4VySpbkujoeCSzoIGTlQ2ae96vT4sZURferQ8GpS/iExpblSX5knD8TBDCt+MK
  UNTpJzPy6HdYGBtKfcc5C0STt07WGnhnOYYrIht1y/blne2Ec90dCt3hQmInqbBUbp1Ngl4V7xXH
  rSifvQ6X+Dzg10l/vx92vFwBM3we+7p8jbDey9KLWS44W/AXmcxmuBo4kTN4fS9Ld/ctMR7ATbP2
  frjcHJoecsQs3tnK1VZjrnnQUsZxDqjWhYDx2w==
                          &lt;/ds:Modulus&gt;
                          &lt;ds:Exponent&gt;AQAB&lt;/ds:Exponent&gt;
                      &lt;/ds:RSAKeyValue&gt;
                  &lt;/ds:KeyValue&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt;
  MIICwTCCAamgAwIBAgIITKhEP4iHnaQwDQYJKoZIhvcNAQENBQAwDjEMMAoGA1UEAwwDa2V5MB4X
  DTE1MDQwMjIxMDAxN1oXDTI1MDQwMjIxMDAxN1owDjEMMAoGA1UEAwwDa2V5MIIBIjANBgkqhkiG
  9w0BAQEFAAOCAQ8AMIIBCfKCAQEA1Bphf/ypmjIyIbWKBS39IaBpUn/e7oylpexMhTtsKYnbKuuf
  zDhReR15oJ9cavVa9BkSSmLjaLxtjIzIswaoW0SnTR4VySpbkujoeCSzoIGTlQ2ae96vT4sZURfe
  rQ8GpS/iExpblSX5knD8TBDCt+MKUNTpJzPy6HdYGBtKfcc5C0STt07WGnhnOYYrIht1y/blne2E
  c90dCt3hQmInqbBUbp1Ngl4V7xXHrSifvQ6X+Azg10l/vx92vFwBM3we+7p8jbDey9KLWS44W/AX
  mcxmuBo4kTN4fS9Ld/ctMR7ATbP2frjcHJoecsQs3tnK1VZjrnnQUsZxDqjWhYDx2wIDAQABoyMw
  ITAOBgNVHQ8BAf8EBAMCBLAwDwYDVR0TAQH/BAUwAwEBADANBgkqhkiG9w0BAQ0FAAOCAQEAa3VI
  zBGyt7mfHh9g9hAKYxUHkrPjiOQDoE3QP/2aZQlGMeD8OwgjZHA4d2iXLLOJt56lgQenEO2nFLxE
  /SSEc4eOFHYR170W7eRuEqIByZhtu1DDMzCVzxTF/Gu/WtTeQzhu4q1Pl9zUyYeHhLIO+HzLJCn0
  O2y6tD/E6zqqzPFSW1oXuISM4ZvFR+0wQgdgYMJa5JU6XwPvS2+7y2B28JFBUq90S4a4FVj65UT5
  qrcgzi4Z2YF2phAD7Jkq3Oqdedmh9q1mg2VFg7v2/Kn+McTLSb0uX7svXMOr2IhZ1FppziQYx3UN
  XPrBbbomwNITW6R56wCmB2nAcp93f9xrKw==
                      &lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/ds:Signature&gt;
      &lt;/CD&gt;    
      &lt;CD&gt;
          &lt;TITLE&gt;Hide your heart&lt;/TITLE&gt;
          &lt;ARTIST&gt;Bonnie Tyler&lt;/ARTIST&gt;
          &lt;COUNTRY&gt;UK&lt;/COUNTRY&gt;
          &lt;COMPANY&gt;CBS Records&lt;/COMPANY&gt;
          &lt;PRICE&gt;9.90&lt;/PRICE&gt;
          &lt;YEAR&gt;1988&lt;/YEAR&gt;
      &lt;/CD&gt;
      &lt;CD&gt;
          &lt;TITLE&gt;Greatest Hits&lt;/TITLE&gt;
          &lt;ARTIST&gt;Dolly Parton&lt;/ARTIST&gt;
          &lt;COUNTRY&gt;USA&lt;/COUNTRY&gt;
          &lt;COMPANY&gt;RCA&lt;/COMPANY&gt;
          &lt;PRICE&gt;9.90&lt;/PRICE&gt;
          &lt;YEAR&gt;1982&lt;/YEAR&gt;
      &lt;/CD&gt;   
  &lt;/CATALOG&gt;
  </code></pre>
  
  <p>Does the fact that the <code>&lt;Signature&gt;</code> is enveloped under <code>&lt;CD&gt;</code> means that it signs exactly the  element, or because of the <code>&lt;ds:Reference URI=""&gt;</code> it means that the whole XML is signed? From reading the specification <a href="http://www.w3.org/TR/xmldsig-core/" rel="nofollow">http://www.w3.org/TR/xmldsig-core/</a> I'm left with the impression that enveloped signatures don't need Reference URI's. Is this correct?</p>