Enveloped Signatures

In an enveloped signature, the signed or to-be-signed data is an XML document and contains the <ds:Signature> element as its child element.

Note   The content of <ds:Signature> element is excluded from the calculations of the signature value (that is, the content of <ds:SignatureValue>) of an enveloped signature.

The following is an example of enveloped signatures.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE Envelope [
  <!ENTITY ds "http://www.w3.org/2000/09/xmldsig#">
  <!ENTITY c14n "http://www.w3.org/TR/2001/REC-xml-c14n-20010315">
  <!ENTITY xpath "http://www.w3.org/TR/1999/REC-xpath-19991116">
  <!ENTITY xslt "http://www.w3.org/TR/1999/REC-xslt-19991116">
  <!ENTITY digest "http://www.w3.org/2000/09/xmldsig#sha1">
]>
<Letter>
   <Return-address>...</Return-address>
   <To>...</To>
   <Message>...</Message>
   <From>
      <ds:Signature xmlns:ds="&ds;">
         <ds:SignedInfo>
         ...
         <ds:Reference URI="">
             <ds:Transforms>
                <ds:Transform Algorithm="&xpath;">
                    <XPath xmlns:dsig="&ds;">
                       not(ancestor-or-self::dsig:Signature)
                    </XPath>
                </ds:Transform>
             </ds:Transforms>
             <ds:DigestMethod Algorithm="&digest;"/>
             <ds:DigestValue></ds:DigestValue>
         </ds:Reference>
         </ds:SignedInfo>
      </ds:Signature>
   </From>
   <Attach>...</Attach>
</Letter>

The data referenced in the <ds:Signature> element and specified by the "URI=''" attribute of the <ds:Reference> descendant element is the entire <Letter> element, including <ds:Signature> itself.