Question

I need to compare two XMLs, which I get in the form of strings. I can’t just compare the strings, because that fails when attributes are listed in a different order, which I don’t want to consider a difference with regards to the XMLs.

There exists several libraries for this problem as described, but I have additional constraints regarding security. Since the XML is customer data, our company security policy demands that all functions operating on the data are cryptographically secure.

So I guess what I need is a cryptographically secure XML comparator, which I can’t seem to find anywhere. Can anyone please point me towards either a library or code sample, preferably in C#.Net, I can use or at least look at? Whether the cryptography is in the form of SSL, AES, CAST5 or whatever is not important as long as it is established and proven.

Answer 1

Convert the XML to Canonical XML or Exclusive Canonical XML and perform a binary comparison. These canonicalization algorithms are used in XML-DSIG, so they should qualify as “cryptographically secure”.

You can use something like this:

  XmlDocument doc = new XmlDocument();
  doc.LoadXml(xml);
  System.Security.Cryptography.Xml.Transform t = new System.Security.Cryptography.Xml.XmlDsigC14NTransform();
  // or System.Security.Cryptography.Xml.XmlDsigExcC14NTransform
  t.Resolver = null;
  t.LoadInput(doc);
  Stream stream = (Stream)t.GetOutput(typeof(Stream));
  string canonicalXml = new StreamReader(stream).ReadToEnd();