- Home
- Download

- GitHub

- News
- Documentation

- FAQ
- Tutorial
- API reference
- Examples

- XML Digital Signature
- XML Encryption
- XML Canonicalization
- Reporting Bugs
- Mailing list
- Related
- Authors

# XML Security Library

XML Security Library is a C library based on LibXML2. The library supports major XML security standards:

- XML Signature
- XML Encryption
- Canonical XML (part of the LibXML2)
- Exclusive Canonical XML (part of the LibXML2)

XML Security Library is released under the MIT Licence see the Copyright file in the distribution for details.

News

- July 19, 2024
  The XML Security Library 1.3.5 and legacy 1.2.41 releases include the following changes:
  - (xmlsec-mscng,xmlsec-mscrypto) Improved certificates verification.
  - (xmlsec-gnutls) Added support for self-signed certificates.
  - (xmlsec-core) Fix deprecated functions in LibXML2 2.13.1 including disabling HTTP support by default (use ''--enable-http' option to re-enable it).
  - Several other small fixes (see more details).
- July 11, 2024
  The legacy XML Security Library 1.2.40 release includes the following changes:
  - (xmlsec-core) Fixed functions deprecated in LibXML2 2.13.1 (including disabling HTTP support by default).
  - (xmlsec-nss) Increased keys size in all tests to support NSS 3.101.
  - (windows) Added "ftp" and "http" flags in 'configure.js' (both are disabled by default).
  - Several other small fixes (more details).
- April 9, 2024
  The XML Security Library 1.3.4 release includes the following changes:
  - (xmlsec-openssl) Support cert dates before unix epoch start.
  - (xmlsec-openssl) Fix build for LibreSSL or BoringSSL.
  - (xmlsec-nss) Ensure NSS algorithms are initialized.
  - Several other small fixes (see more details).
- January 4, 2024
  The XML Security Library 1.3.3 release includes the following changes:
  - (xmlsec-core) Disabled KeyValue and DEREncodedKeyValue XML nodes by default. Use the '--enabled-key-data' option for the xmlsec command line utility or update the 'keyInfoCtx.enabledKeyData' parameter if you need to re-enable these nodes (also see question 3.5 in the FAQ).
  - (xmlsec-core) Removed '--enable-size-t' ('size_t' for MSVC builds) option and made 'xmlSecSize' to always be the same as 'size_t'.
  - (xmlsec-core) Removed previously deprecated functions, defines, etc.
  - (xmlsec-core) Fixed build for libxml2 v2.12.0.
  - (xmlsec-openssl) Removed support for OpenSSL 1.1.0 (end of life in Aug 2016). The minimum OpenSSL supported version is 1.1.1; the version 3.0.0 or greater is recommended.
  - (xmlsec-nss) Added runtime check for the enabled algorithms in NSS.
  - (xmlsec-mscrypto) Removed NT4 support.
  - Several other small fixes (see more details).
- December 12, 2023
  The legacy XML Security Library 1.2.39 release includes the following changes:
  - Added options to enable/disable local files, HTTP, and FTP support. FTP is disabled by default.
  - Several other small fixes (more details).
- October 31, 2023
  The XML Security Library 1.3.2 release includes the following changes:
  - (xmlsec-openssl) Fixed padding for GOST 2001 and 2012 signatures.
  - (xmlsec-nss) Added support for reading PEM certificates.
  - (xmlsec-nss) Added a check to ensure that the key certificate matches the key.
  - (xmlsec-nss) Added support for xmlsec command line tool '--verify-keys' option.
  - (xmlsec-gnutls) Added support for GOST R 34.11-94, GOST R 34.11-2012 256 bit, and GOST R 34.11-2012 512 bit digest algorithms.
  - (xmlsec-gnutls) Added support for GOST R 34.10-2001, GOST R 34.11-2012 256 bit, and GOST R 34.11-2012 512 bit signature algorithms.
  - (xmlsec-gnutls) Added support for xmlsec command line tool '--verify-keys' option.
  - (xmlsec-gnutls) Added check to ensure that the key certificat matches the key.
  - (xmlsec-mscng) Added support for xmlsec command line tool '--verify-keys' option.
  - (xmlsec-mscng) Replaced windows.h includes with wincrypt.h includes where possible.
  - (xmlsec-mscrypto) Replaced windows.h includes with wincrypt.h includes where possible.
  - (xmlsec command line tool) Added '--base64-line-size' option to control the base64 encoding line size.
  - (MSVC build) Added 'ftp' and 'http' options to control FTP and HTTP support. FTP support is disabled by default.
  - (MinGW build) The xmlsec-mscrypto is moved down in the default crypto library selection list as it is now in maintanance mode (use '--with-default-crypto' option to force the selection).
  - (MinGW build) Fixed the static libraries build with "--enable-static-linking" option.
  - Several other small fixes (see more details).
- July 5, 2023
  The legacy XML Security Library 1.2.38 release includes the following changes:
  - Fixed static linking with MinGW.
  - (xmlsec-mscng) Fixed block ciphers key size.
  - Several other small fixes (more details).
- June 6, 2023
  The XML Security Library 1.3.1 release includes the following changes:
  - Added "--with-libltdl" option for ./configure to allow custom libltdl installations and deprecated "--enable-crypto-dl" option.
  - Added support for cclang compiler on non-MacOSX platforms.
  - (xmlsec-openssl) Restored support for LibreSSL and bumped minimum required version to 3.5.0.
  - (xmlsec-nss) Restored minimum supported NSS version to 3.35.
  - Several other small fixes (more details).
- April 12, 2023
  The XML Security Library 1.3.0 release includes the following changes:
  - core xmlsec and all xmlsec-crypto libraries:
    - (ABI breaking change) Added support for the KeyInfoReference Element.
    - (ABI breaking change) Switched xmlSecSize to use size_t by default. Use "--enable-size-t=no" configure option ("size_t=no" on Windows) to restore the old behaviour (note that support for xmlSecSize being different from size_t will be removed in the future).
    - (API breaking change) Changed the key search to strict mode: only keys referenced by KeyInfo are used. To restore the old "lax" mode, set XMLSEC_KEYINFO_FLAGS_LAX_KEY_SEARCH flag on xmlSecKeyInfoCtx or use '--lax-key-search' option for XMLSec command line utility.
    - (API breaking change) The KeyName element content is now trimmed before key search is performed.
    - (API breaking change) Disabled FTP support by default. Use "--enable-ftp" configure option to restore it. Also added "--enable-http" and "--enable-files" configure options to control support for loading files over HTTP or locally.
    - (API/ABI breaking change) Disabled MD5 digest method by default. Use "--enable-md5" configure options ("legacy-crypto" option on Windows) to re-enable MD5.
    - (ABI breaking change) Added "failureReason" file to xmlSecDSigCtx and xmlEncCtx to provide more granular operation failure reason.
    - (ABI breaking change) Removed deprecated functions.
    - Added support for loading keys through ossl-store interface (e.g. for using keys from an HSM). Also see '--privkey-openssl-store' and '--pubkey-openssl-store ' command line options for XMLSec utility.
    - Added ability to control transforms binary chunk size to improve performance (see '--transform-binary-chunk-size' command line option for XMLSec utility).
    - Fixed all potentially unsafe integer conversions and all the other warnings.
    - Added XML Signature 1.1 interop (2012) and XML Encryption 1.1 interop (2012) tests.
  - xmlsec-openssl library:
    - Added support for SHA3 digests.
    - Added support for ECDSA-SHA3 signatures.
    - Added support for RSA PSS signatures (withtout parameters).
    - Added support for ConcatKDF key and PBKDF2 derivation algorithms.
    - (ABI breaking change) Added support for ECDH-ES Key Agreement algorithm.
    - (ABI breaking change) Added support for DH-ES Key Agreement algorithm with explicit KDF.
    - Added support for MGF1 algorithm to RSA OAEP key transport.
    - Added support for X509Digest element and ability to lookup keys using other X509Data elements.
    - Added support for DEREncodedKeyValue element.
    - Automatically set key name from PKCS12 key name.
    - Removed support for OpenSSL 1.0.0 and LibreSSL before 2.7.0.
  - xmlsec-nss llegacyibrary:
    - Added support for RSA PSS signatures (withtout parameters).
    - Added support for RSA OAEP key transport including MGF1 algorithms.
    - Added support for AES GCM ciphers.
    - Added support for PBKDF2 derivation algorithm.
    - Added support for X509Digest element and ability to lookup keys using other X509Data elements.
    - Added support for DEREncodedKeyValue element.
    - Automatically set key name from PKCS12 key name.
  - xmlsec-gnutls library:
    - (API/ABI breaking change) Removed dependency on xmlsec-gcrypt and libgcrypt libraries (including API functions) to enable support for different GnuTLS backends.
    - Bumped minimal GnuTLS version to 3.6.13.
    - Added support for SHA3 digests.
    - Added support for ECDSA signatures.
    - Added support for DSA-SHA256 signatures.
    - Added support for RSA PSS signatures (withtout parameters).
    - Added support for RSA PKCS 1.5 key transport.
    - Added support for AES GCM ciphers.
    - Added support for PBKDF2 derivation algorithm.
    - Added support for X509Digest element and ability to lookup keys using other X509Data elements.
    - Added support for DEREncodedKeyValue element.
    - Automatically set key name from PKCS12 key name.
  - xmlsec-mscng library:
    - Added support for RSA PSS signatures (withtout parameters).
    - Added support for MGF1 algorithm to RSA OAEP key transport.
    - (ABI breaking change) Added support for ECDH-ES Key Agreement algorithm.
    - Added support for ConcatKDF key and PBKDF2 derivation algorithms.
    - Added support for X509Digest element for keys and certificates lookup from the system stores (only SHA1 is supported).
    - Added support for DEREncodedKeyValue element.
    - Automatically set key name from PKCS12 key name.
  - xmlsec-mscrypto library:
    - In maintenance mode starting from this release.
    - Disabled by default support for NT4. Use "nt4=yes" configure option on Windows to re-enable it.
  - xmlsec-gcrypt library:
    - In maintenance mode starting from this release.
    - Added support for SHA3 digests.
    - Added support for ECDSA signatures.
    - Added support for RSA PSS signatures (withtout parameters).
    - Added support for RSA PKCS 1.5 key transport.
    - Added support for RSA OAEP key transport including MGF1 algorithms.
  - xmlsec command line utility:
    - (API breaking change) The XMLSec command line utility is using 'strict' key search mode by default. To restore the old 'lax' key search mode, use the new '--lax-key-search' option.
    - (API breaking change) The XMLSec command line utility is no longer prints detailed errors by default. To restore the detailed errors, use the new '--verbose' option.
    - Added '--transform-binary-chunk-size' option to control transforms binary chunk size (increasing the chunk size should improve performance at the expense of memory usage.
    - Added slegacyupport for loading keys through ossl-store interface (e.g. for using keys from an HSM). Also see '--privkey-openssl-store' and '--pubkey-openssl-store ' command line options for XMLSec utility.
    - Added '--enabled-key-info-reference-uris' option to control processing of the the KeyInfoReference Element.
    - Added '--pbkdf2-key' option for loading PBKDF2 keys.
    - Added '--concatkdf-key' option for loading ConcatKDF keys.
    - Added '--hmac-min-out-len' option to control the min accepted HMAC Output length.
    - Added '--pubkey-openssl-engine' option to load public keys from OpenSSL engine.
    - Added '--crl-pem' and '--crl-der' options to load CRLs.
    - Added '--verify-keys' option to verify key's certificate before loading into Keys Manager (only supported for OpenSSL currently).
    - Enabled templatized output filenames to facilitate batch operations on multiple input files.

  Detailed information about supported algorithms can be found here: XMLDsig and XMLEnc interoperability reports.

- November 30, 2022
  The XML Security Library 1.2.37 release includes the following changes:
  - Fixed two regressions from 1.2.36 release: issue #437 and issue #449.
- October 31, 2022
  The XML Security Library 1.2.36 release includes the following changes:
  - Retired the XMLSec mailing list "xmlsec@aleksey.com" and the XMLSec Online Signature Verifier.
  - Several other small fixes (more details).
- October 25, 2022
  The XML Security Library 1.2.35 release includes the following changes:
  - Migration to OpenSSL 3.0 API (based on PR by @snargit). Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use "--enable-openssl3-engines" configure flag (there will be a lot of deprecation warnings).
  - The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library.
  - Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled "-Werror" and "-pedantic" flags on CI builds.
  - Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility).
  - Moved all CI builds to GitHub actions.
  - Several other small fixes (more details).

News page