What appears below are my personal notes I wish were part of my long-term memory but don't always seem to fit. I strive for accuracy and clarity and appreciate feedback. If applying any of this information anywhere, confirm for youself the correctness of your work as what you see below might very well be, albeit unintentionally, incorrect or misleading. These notes are here as an easy reference for myself.

Information worthy of a more formal presentation will appear elsewhere than this "Scratch" area. - ksb

KSB's XML Digital Signature Notes

Detached, Enveloping and Enveloped Signatures

I think I've finally gotten these straight in my head now. The terms: "detached", "enveloping" and "enveloped" describe the relationship of the signed data with the signature element. The URI attribute of the reference tag points to the location of the signed data.

• Detached means that the signed data is not in the signature element - it is elsewhere in the XML document or in some remote location.
  "The signature and signed data are detached from one another."


• Enveloping means that the signed data is in the signature element.
  "The signature is enveloping the signed data."
  The signature is the parent tag of the URI reference.


• Enveloped means that the signature is part of the signed data.
  "The signature is enveloped by the signed data."
  The signature is a child tag of the URI reference.

References

• W3C XML-Signature Spec
• W3C SOAP Signature Spec
• Intro to XML Dig Sig (xml.com)