[System.Security.Cryptography.Xml] Add Canonical XML 1.1 (C14N 1.1) support to SignedXml

[marcus905]

Description

System.Security.Cryptography.Xml.SignedXml does not appear to support the W3C Canonical XML 1.1 algorithm:

http://www.w3.org/2006/12/xml-c14n11

This algorithm is used in real-world XML digital signatures, including XAdES-signed business documents.

When such a signature is loaded/validated, the canonicalization transform cannot be resolved by the current implementation.

The namespace currently exposes implementations for the existing XML signature/canonicalization infrastructure, but there does not appear to be a built-in Canonical XML 1.1 transform.

Reproduction Steps

• Create a console application targeting a currently supported .NET version.
• Add/reference System.Security.Cryptography.Xml.
• Load an XMLDSIG whose is http://www.w3.org/2006/12/xml-c14n11.
• Create SignedXml and call LoadXml() on the element.
• Attempt CheckSignature().
• Observe that C14N 1.1 cannot be resolved/processed by the built-in implementation.

The test file attached is a valid public test file filed in this Apache issue

test143.xml

Expected behavior

SignedXml should be able to create and validate XML signatures using Canonical XML 1.1, in the same way that the existing canonicalization algorithms are supported.

Actual behavior

XML signatures using http://www.w3.org/2006/12/xml-c14n11 cannot be validated without a custom implementation.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

We have encountered production XAdES documents using Canonical XML 1.1. These signatures are otherwise structurally valid but cannot be verified using the current System.Security.Cryptography.Xml implementation.

This also affects downstream platforms wrapping SignedXml, such as Microsoft Dynamics 365 Business Central.

I would be willing to contribute an implementation if the maintainers consider Canonical XML 1.1 appropriate for this package.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-xml
See info in area-owners.md if you want to be subscribed.

[bartonjs]

https://github.com/dotnet/runtime/blob/main/src/libraries/System.Security.Cryptography.Xml/README.md lists our contribution bar for this package: We only consider fixes that unblock critical issues

We aren't accepting new features.