Key not found using DSAKeyValue

[timlegge]

I have the following two signed xml files and I am using the same command line to verify them:

xmlsec1 --verify --pubkey-cert-pem t/dsa.public-2048.pem --trusted-pem t/dsa.public-2048.pem --id-attr:ID "foo" t/RvisfyLHNr

The first used the DSAKeyValue for the key

<?xml version="1.0"?>
<foo ID="123"><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
            <dsig:SignedInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <dsig:SignatureMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
                <dsig:Reference URI="#123">
                        <dsig:Transforms>
                            <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </dsig:Transforms>
                        <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                        <dsig:DigestValue>+kB2WZQwKaD697+0BVKRAQ9pAz9ykLSDULHkOgPrFV0=</dsig:DigestValue>
                    </dsig:Reference>
            </dsig:SignedInfo>
            <dsig:SignatureValue>GIvYxfH8UGY5X2kSb7VYXxMj4GIBy6/shdec5O8HFSQ3Ssl/4lJwyCgT+ie3GH8SuY/hfLmHebIO
Rv91iuoNNg==
</dsig:SignatureValue>
            <dsig:KeyInfo>
                             <dsig:KeyValue>
                              <dsig:DSAKeyValue>
                               <dsig:P>9bRUSRJ5E1pQDAojC27Xn/L8psELQcNlepPtw9pdxueKdokFePz047btYMVfKaFyArnGpOroKxkxCwqf9KEig1xs7RLNTyqNfs/Ffn2fc5cHiwc6o4QZ4tRSseWJPbnMq/AM5fNhtgNNqHBAobR1IyOY0nUXABdtvR0BqluE7RUuZs0lgWFfxPeV8kCZqPliraXc4vMXcxoDMb/W5ubtenzsgpOKbpPa/4dLxomkNaG18vqExMS3iZDRsWl2DuJ0B59JAlbyAKBkZfJv9nB3bI/eeR0xOssAsY6icLlAk8s1M4khFOlMOyQpcAHv1X2a5/nPVQynGnLJr9IPg79Pxw==</dsig:P>
                               <dsig:Q>7ldaXCxY+LZ3UcUpm9ReUIN2JfzVEdkQz+WAsM0vVZM=</dsig:Q>
                               <dsig:G>vlgfbHotkzlNmRS/RHZ6mSpJD6zzgGuPeTKkEiRk5At1OWD6RF8d/QtR+5FRqYs2vUqZnbbJ3Xr/K4t64jEagiz2CN+T11lDiujSHvUhqtgw9FFnnogOkI+7tew/yYr38YAEhSmUxBYZYCONVOe+s65hCutel+Z56sIXQX/68lCrCUubnygjvklezII1m2vB1n+rHsN8z+8WSKZbkIN48Yx8fAdc8A1x/UeQq/wCyGqTjNsP7auQhUnXfUygpPf4txDEEPW4/vrUm6NB8gifA3g/V9BZEu86/8qZfQxkPS855iB8+f2lAKPnX57XSnZQwKZa47XpEeGYtrFOtYUHmQ==</dsig:G>
                               <dsig:Y>niFEZS703ImJr1ufn0OJPQw2y+fB4z4V+itEyncx2Xw/nBbw6C3Gnfr2eR9/RBccH+jtD17MbmR0IaVXk+omHUW5H75vdHdJiKJIFESBu/pPqQaGtWsU7oY7pfR1ldrDQHIMzKbmbHZBkbtAlL3Iu8d0oCFFnHGCZwjV0eaHvI6GsgCIuFCNq0xdaqhZ/cTH9RfbxT5InwqjmwcccQMbsg5TY2JDKvAg1ODEPMvfWZAJ4G5Fywse5fLBaZWvxw51NOSbYMerqyI/JjK7L1ibd+kTWhBb31KH5TQ8OBvD6QMaA9DmsewhpIttzEutt7wigTqboyrPd1JRWTCuM/musw==</dsig:Y>
                              </dsig:DSAKeyValue>
                             </dsig:KeyValue>
                            </dsig:KeyInfo>
        </dsig:Signature></foo>

The second uses X509Certificate

<?xml version="1.0"?>
<foo ID="123"><dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
            <dsig:SignedInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <dsig:SignatureMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
                <dsig:Reference URI="#123">
                        <dsig:Transforms>
                            <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </dsig:Transforms>
                        <dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                        <dsig:DigestValue>+kB2WZQwKaD697+0BVKRAQ9pAz9ykLSDULHkOgPrFV0=</dsig:DigestValue>
                    </dsig:Reference>
            </dsig:SignedInfo>
            <dsig:SignatureValue>OgZ5pwUSzzDyiYNnO5DTA8x+Uc6zntpsQu0JXVRGvKygTWvLgwVqsAMN7uHYjEKCfi8rqxrn2nIm
hZ1YSz7lPw==
</dsig:SignatureValue>
            <dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>
MIIFGTCCBL0CFEmIQRVYxCSW4+co9lPbBEVtPG1pMAsGCWCGSAFlAwQDAjCBlDEL
MAkGA1UEBhMCQ0ExFjAUBgNVBAgMDU5ldyBCcnVuc3dpY2sxEDAOBgNVBAcMB01v
bmN0b24xHTAbBgNVBAoMFFhNTDo6U2lnIFBlcmwgTW9kdWxlMR0wGwYDVQQLDBRY
TUw6OlNpZyBQZXJsIE1vZHVsZTEdMBsGA1UEAwwUWE1MOjpTaWcgUGVybCBNb2R1
bGUwHhcNMjIwMzE1MjM0NjQ2WhcNMzIwMzEyMjM0NjQ2WjCBlDELMAkGA1UEBhMC
Q0ExFjAUBgNVBAgMDU5ldyBCcnVuc3dpY2sxEDAOBgNVBAcMB01vbmN0b24xHTAb
BgNVBAoMFFhNTDo6U2lnIFBlcmwgTW9kdWxlMR0wGwYDVQQLDBRYTUw6OlNpZyBQ
ZXJsIE1vZHVsZTEdMBsGA1UEAwwUWE1MOjpTaWcgUGVybCBNb2R1bGUwggNIMIIC
OgYHKoZIzjgEATCCAi0CggEBAPW0VEkSeRNaUAwKIwtu15/y/KbBC0HDZXqT7cPa
XcbninaJBXj89OO27WDFXymhcgK5xqTq6CsZMQsKn/ShIoNcbO0SzU8qjX7PxX59
n3OXB4sHOqOEGeLUUrHliT25zKvwDOXzYbYDTahwQKG0dSMjmNJ1FwAXbb0dAapb
hO0VLmbNJYFhX8T3lfJAmaj5Yq2l3OLzF3MaAzG/1ubm7Xp87IKTim6T2v+HS8aJ
pDWhtfL6hMTEt4mQ0bFpdg7idAefSQJW8gCgZGXyb/Zwd2yP3nkdMTrLALGOonC5
QJPLNTOJIRTpTDskKXAB79V9muf5z1UMpxpyya/SD4O/T8cCIQDuV1pcLFj4tndR
xSmb1F5Qg3Yl/NUR2RDP5YCwzS9VkwKCAQEAvlgfbHotkzlNmRS/RHZ6mSpJD6zz
gGuPeTKkEiRk5At1OWD6RF8d/QtR+5FRqYs2vUqZnbbJ3Xr/K4t64jEagiz2CN+T
11lDiujSHvUhqtgw9FFnnogOkI+7tew/yYr38YAEhSmUxBYZYCONVOe+s65hCute
l+Z56sIXQX/68lCrCUubnygjvklezII1m2vB1n+rHsN8z+8WSKZbkIN48Yx8fAdc
8A1x/UeQq/wCyGqTjNsP7auQhUnXfUygpPf4txDEEPW4/vrUm6NB8gifA3g/V9BZ
Eu86/8qZfQxkPS855iB8+f2lAKPnX57XSnZQwKZa47XpEeGYtrFOtYUHmQOCAQYA
AoIBAQCeIURlLvTciYmvW5+fQ4k9DDbL58HjPhX6K0TKdzHZfD+cFvDoLcad+vZ5
H39EFxwf6O0PXsxuZHQhpVeT6iYdRbkfvm90d0mIokgURIG7+k+pBoa1axTuhjul
9HWV2sNAcgzMpuZsdkGRu0CUvci7x3SgIUWccYJnCNXR5oe8joayAIi4UI2rTF1q
qFn9xMf1F9vFPkifCqObBxxxAxuyDlNjYkMq8CDU4MQ8y99ZkAngbkXLCx7l8sFp
la/HDnU05Jtgx6urIj8mMrsvWJt36RNaEFvfUoflNDw4G8PpAxoD0Oax7CGki23M
S623vCKBOpujKs93UlFZMK4z+a6zMAsGCWCGSAFlAwQDAgNJADBGAiEAqtaXbVqD
cgQiTo88Ty2Gabz/ZNvelEZd+rMb7lvbg80CIQClxGYMahmECIojfZxVQghfU4Uv
l9vzgsXC/CG39H7cIA==
</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo>
        </dsig:Signature></foo>

I receive an error for the DSAKeyValue:

Verification status: FAILED
# Failure reason: KEY-NOT-FOUND

This did used to work and I doing something incorrect or was the DSAKeyValue dropped?

[lsh123]

I really apologize for missing your question.

The DSAKeyValue (and other key values) are disabled by default due to security risks of using a key without validation. It's discussed in the FAQ 3.5 here:

https://www.aleksey.com/xmlsec/faq.html

You need to add parameter --enabled-key-data dsa,key-value as follows to re-enable it:

xmlsec1 --verify --enabled-key-data dsa,key-value --id-attr:ID "foo" t/RvisfyLHNr