| Previous | Next |
| STATUS_XML_PARSE_ERROR | STATUS_WRONG_COMPARTMENT |
STATUS_XMLDSIG_ERROR
The XML signature pipeline could not produce a trusted result
XML Signature validation is more than checking the visible SignatureValue. Each Reference identifies data, optional transforms produce the signed representation, a digest is compared, SignedInfo is canonicalized, and the signature over SignedInfo is verified with an accepted key. A failure at any stage can surface through this status.
Reserializing XML can change namespace declarations, whitespace, attribute ordering as represented before canonicalization, or reference resolution. The document can therefore remain well-formed while its signature fails. Diagnostics should identify whether the failing stage is reference lookup, transform processing, digest comparison, canonicalization, key selection, or final signature verification.
What to inspect
- Record CanonicalizationMethod, SignatureMethod, every Reference URI, Transform, DigestMethod, and DigestValue.
- Resolve references in the same security context and base URI used by the original verifier.
- Check for duplicate IDs or unexpected reference targets rather than validating only the first matching element.
- Preserve the original XML bytes and avoid pretty-printing or normalizing the signed document.
References
- Microsoft Open Specifications: NTSTATUS values
- W3C: XML Signature Syntax and Processing 1.1
- W3C: XML 1.0
- Microsoft Windows SDK metadata: ntstatus.h
Looking for a different code? Search another status or error code.