XML Attribute Whitespace Normalization Explained

XML attribute value normalization is the standardized process XML parsers and canonicalization algorithms use to clean and standardize whitespace characters—spaces, tabs, carriage returns, and line feeds—inside attribute values. In digital signatures and XML processing, understanding this behavior is critical because cryptographic signatures rely on deterministic byte-level representations, meaning any unintended whitespace alteration will cause signature validation to fail.

Basic XML Normalization Rules

According to the W3C XML 1.0 specification, an XML processor normalizes all attribute values before passing them to an application based on the attribute’s declared type.

1. CDATA Attributes and Undeclared Types

For generic CDATA attributes (or attributes without a DTD/schema definition): * Any carriage return and line feed sequence (\r\n) or standalone carriage return (\r) is normalized to a single line feed (\n) during line-end handling. * Every whitespace character—horizontal tab (\t), line feed (\n), and carriage return (\r)—is replaced with a single standard space character (  or U+0020). * Multiple consecutive spaces and leading or trailing spaces are preserved as distinct space characters.

2. Non-CDATA Attributes

For normalized token-based types (such as ID, IDREF, ENTITY, NMTOKEN, or enumerated types): * All whitespace characters (\t, \n, \r) are first replaced with standard space characters (U+0020). * Leading and trailing spaces are completely removed (trimmed). * Sequences of multiple consecutive spaces are collapsed into a single space character (U+0020).

Literal Whitespace vs. Character References

XML distinguishes between literal whitespace characters and numeric/entity character references:

• Literal Whitespace: A physical tab or newline typed directly within the attribute value is converted into a standard space (U+0020).
• Character References: If a tab (	), line feed (
), or carriage return (
) is explicitly written as a character reference, the XML parser preserves the intended character value instead of replacing it with a standard space.

Whitespace Handling in Canonical XML (C14N)

In XML Digital Signatures (XMLDSig), the Canonical XML specification (such as C14N 1.0 or Exclusive C14N) standardizes attribute values to guarantee consistent hash generation across different platforms and parsers.

1. Escaping Preserved Whitespace: When character references represent characters that would otherwise be normalized away (like 	, 
, and 
), Canonical XML outputs them as explicit numeric character references in uppercase hexadecimal notation (	, 
, 
) to preserve their exact byte values across parsing rounds.
2. Standard Space Handling: Standard space characters (U+0020) are output directly as literal spaces.
3. Attribute Delimiter Standardization: All attribute values are normalized to use double quotes ("..."), and any double quote within the value is escaped as ".

By enforcing these deterministic normalization rules, XML processors ensure that attribute values produce identical byte sequences, maintaining the integrity of digital signatures.