dotnet/wpf · error · XmlException

SR.UnsupportedCanonicalizationMethod

Error message

SR.UnsupportedCanonicalizationMethod

What it means

Per the OPC spec only two canonicalization methods are allowed in a package signature's SignedInfo. EnsureXmlSignatureParsed checks SignedInfo.CanonicalizationMethod against IsValidXmlCanonicalizationTransform and throws XmlException(SR.UnsupportedCanonicalizationMethod) for any other method.

Solutions

  1. Re-sign the package using an OPC-supported canonicalization method (set SignedInfo.CanonicalizationMethod to an approved algorithm, e.g. XmlDsigC14NTransform).
  2. Edit the CanonicalizationMethod Algorithm URI in the signature part to a supported value (only valid if you can recompute signatures).
  3. Verify with a full .NET XmlDigitalSignature stack or third-party library that supports the method used.
  4. Configure the signing component to restrict canonicalization to the OPC-permitted algorithms.

Example fix

// before (signing code)
signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;
// after
signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigC14NTransformUrl;
Defensive patterns

Strategy: validation

Validate before calling

var c14n = doc.SelectSingleNode("//*[local-name()='SignedInfo']/*[local-name()='CanonicalizationMethod']/@Algorithm")?.Value;
bool c14nOk = c14n == "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
           || c14n == "http://www.w3.org/2006/12/xml-c14n11"; // OPC-permitted methods

Try / catch

try { dsm.VerifySignatures(); }
catch (XmlException ex) when (ex.Message.Contains("Canonicalization")) { /* verify with a full XML-DSig stack instead */ }

Prevention

When it happens

Trigger: Verifying a package signature whose <CanonicalizationMethod Algorithm=...> is not one of the two OPC-permitted canonicalization algorithms (e.g. exclusive C14N where only inclusive variants are accepted, or a custom algorithm URI).

Common situations: Signatures generated by other stacks (Java security toolkits, XAdES signers, OpenSSL-based tools) defaulting to xml-exc-c14n; changing canonicalization settings in a signing service; cross-platform document signing workflows verified in WPF.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/7a5a335e8c639f19. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:653

                            node = nodeList[1];
                        }

                        if ((node.NodeType != XmlNodeType.Element) ||
                           (!string.Equals(node.NamespaceURI, SignedXml.XmlDsigNamespaceUrl, StringComparison.Ordinal)) ||
                           (!string.Equals(node.LocalName, XTable.Get(XTable.ID.SignatureTagName), StringComparison.Ordinal)))
                        {
                            throw new XmlException(SR.PackageSignatureCorruption);
                        }

                        // instantiate the SignedXml from the xmlDoc
                        _signedXml.LoadXml((XmlElement)node);
                    }
                }
            }

            // As per the OPC spec, only two Canonicalization methods can be specified            
            if (!IsValidXmlCanonicalizationTransform(_signedXml.SignedInfo.CanonicalizationMethod))
                throw new XmlException(SR.UnsupportedCanonicalizationMethod);

            // As per OPC spec, signature ID must be NCName
            if (_signedXml.Signature.Id != null)
            {
                try
                {
                    System.Xml.XmlConvert.VerifyNCName(_signedXml.Signature.Id);
                }
                catch (System.Xml.XmlException)
                {
                    throw new XmlException(SR.PackageSignatureCorruption);
                }
            }

            return _signedXml;
        }

        //------------------------------------------------------

View on GitHub (pinned to 81131a70a4)