how to create a reference to KeyInfo?

[sibelius]

<Reference
URI=”<unique-id-toKeyInfo>

<KeyInfo Id=”unique-id-to-KeyInfo”>
(...................)
</KeyInfo>

<ds:Reference URI="#key-info-id">
 <ds:Transforms>
 <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
 </ds:Transforms>
 <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
 <ds:DigestValue>J9fL+QyrtblrJnk0gjGnGPaDt42AKfNRM3uv4EbdbrM=</ds:DigestValue>
 </ds:Reference>

[srd90]

Are you aware that this repository has discussions section activated?

IMHO all of these could have been started as questions at discussions instead of issues:

• how to define a xpath when there is a namespace xmlns ? #479
• custom signature tag #480
• how to create a reference to KeyInfo? #481
• how to add Id to KeyInfo tag ? #482
• [ENHANCEMENT]: missing static for some fields #483

Some of those issues were resolved by you with comment like "nevermind"/"got working". If you had an issue why not share solution with others who might have tried to already spend time to replicate your problem with short info that you provided.

[srd90]

Are you after this pending/work in progress enabler:

• [ENHANCEMENT]: Improve experience of adding a Reference to the Signature. #463
• Initial code to sign keyinfo #464

Quote from #463 :

...
Adding a Reference to each part of the document to be signed is cumbersome and still leaves <KeyInfo /> without a Reference.
...

If answer is yes then this question issue is duplicate of enhancement issue #463

[sibelius]

does we have a solution for this ?

or should we use this new patched code ?

[srd90]

does we have a solution for this ?

Where are you point with this question's this?

If your question's this point to this: #463

then you have some initial version of solution available at this draft PR: #464

or should we use this new patched code ?

I cannot figure out whats this question's this could be.

[cjbarth]

@sibelius , As you can see from the issue linked to by @srd90 , I've started work on this, but haven't completed it (and don't see time on the immediate horizon to do so). If you have a solution, or care to collaborate on this, please do so. This would significantly increase the security of this library and make it easier to use.

[sibelius]

Is there any test failing?

[sibelius]

What is missing in your implementation?

[cjbarth]

@sibelius , please continue this discussion on the linked issue or the associated PR. You'll see that there are tests failing. I tried to start with a battery of tests so that I could do test-driven-development with this feature addition, so you should see what the end goal should look like. It is possible that I've gotten the test wrong too (programmers are imperfect).

[srd90]

IMHO this issue could be closed because this is actually duplicate of/work in progress in:

• [ENHANCEMENT]: Improve experience of adding a Reference to the Signature. #463
• Initial code to sign keyinfo #464