title: XML Digital Signature: How is the digest value calculated for same-document reference URIs?
body: <p>My XML digital signature has the following excerpts: </p>
  
  <pre><code>    &lt;Signature Id="idPackageSignature" xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;SignedInfo&gt;
              &lt;CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/&gt;
              &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
              &lt;Reference URI="#idOfficeObject" Type="http://www.w3.org/2000/09/xmldsig#Object"&gt;
                  &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
  
                  &lt;DigestValue&gt;ofqf9+Tj0qTkkExCEOwFz0V4aNo=&lt;/DigestValue&gt;
  
              &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
  
      &lt;Object Id="idOfficeObject"&gt;&lt;SignatureProperties&gt;&lt;SignatureProperty Id="idOfficeV1Details" Target="#idPackageSignature"&gt;&lt;SignatureInfoV1 xmlns="http://schemas.microsoft.com/office/2006/digsig"&gt;&lt;SetupID/&gt;&lt;SignatureText/&gt;&lt;SignatureImage/&gt;&lt;SignatureComments&gt;test&lt;/SignatureComments&gt;&lt;WindowsVersion&gt;6.1&lt;/WindowsVersion&gt;&lt;OfficeVersion&gt;14.0&lt;/OfficeVersion&gt;&lt;ApplicationVersion&gt;14.0&lt;/ApplicationVersion&gt;&lt;Monitors&gt;1&lt;/Monitors&gt;&lt;HorizontalResolution&gt;1920&lt;/HorizontalResolution&gt;&lt;VerticalResolution&gt;1200&lt;/VerticalResolution&gt;&lt;ColorDepth&gt;32&lt;/ColorDepth&gt;&lt;SignatureProviderId&gt;{00000000-0000-0000-0000-000000000000}&lt;/SignatureProviderId&gt;&lt;SignatureProviderUrl/&gt;&lt;SignatureProviderDetails&gt;9&lt;/SignatureProviderDetails&gt;&lt;ManifestHashAlgorithm&gt;http://www.w3.org/2000/09/xmldsig#sha1&lt;/ManifestHashAlgorithm&gt;&lt;SignatureType&gt;1&lt;/SignatureType&gt;&lt;/SignatureInfoV1&gt;&lt;/SignatureProperty&gt;&lt;/SignatureProperties&gt;&lt;/Object&gt;
  </code></pre>
  
  <p>The referenced Object element is supposed to have the digest value <strong>ofqf9+Tj0qTkkExCEOwFz0V4aNo=</strong>. I canonicalize the Object element, and get the following output, which seems correct to me:</p>
  
  <pre><code>&lt;Object Id="idOfficeObject"&gt;&lt;SignatureProperties&gt;&lt;SignatureProperty Id="idOfficeV1Details" Target="#idPackageSignature"&gt;&lt;SignatureInfoV1 xmlns="http://schemas.microsoft.com/office/2006/digsig"&gt;&lt;SetupID&gt;&lt;/SetupID&gt;&lt;SignatureText&gt;&lt;/SignatureText&gt;&lt;SignatureImage&gt;&lt;/SignatureImage&gt;&lt;SignatureComments&gt;test&lt;/SignatureComments&gt;&lt;WindowsVersion&gt;6.1&lt;/WindowsVersion&gt;&lt;OfficeVersion&gt;14.0&lt;/OfficeVersion&gt;&lt;ApplicationVersion&gt;14.0&lt;/ApplicationVersion&gt;&lt;Monitors&gt;1&lt;/Monitors&gt;&lt;HorizontalResolution&gt;1920&lt;/HorizontalResolution&gt;&lt;VerticalResolution&gt;1200&lt;/VerticalResolution&gt;&lt;ColorDepth&gt;32&lt;/ColorDepth&gt;&lt;SignatureProviderId&gt;{00000000-0000-0000-0000-000000000000}&lt;/SignatureProviderId&gt;&lt;SignatureProviderUrl&gt;&lt;/SignatureProviderUrl&gt;&lt;SignatureProviderDetails&gt;9&lt;/SignatureProviderDetails&gt;&lt;ManifestHashAlgorithm&gt;http://www.w3.org/2000/09/xmldsig#sha1&lt;/ManifestHashAlgorithm&gt;&lt;SignatureType&gt;1&lt;/SignatureType&gt;&lt;/SignatureInfoV1&gt;&lt;/SignatureProperty&gt;&lt;/SignatureProperties&gt;&lt;/Object&gt;
  </code></pre>
  
  <p>I store it in a file 'inputxml', and try to get the base64 encoded version of the sha1 digest using the following command:</p>
  
  <pre><code>% shasum inputxml | cut -f 1 -d ' ' | xxd -r -p | base64
  /zTi8HGHX9X+csjULYLt6FLrm3g=
  </code></pre>
  
  <p>The computed digest value does not match what is in the XML signature. What am I doing wrong? I have tried multiple various methods and tweaks, but cannot get the correct digest value. </p>
  
  <p>Note: The XML Signature verifies correctly. So the value is correct, but I am missing some step or detail. Thanks for your help. Please let me know how can I elaborate or clarify my question further if it is not very clear.</p>