Re: http://dev.w3.org/2006/waf/widgets-digsig/tests/#automated-testing

Kai

yes, OCSP and cert validation is entirely optional, as is inclusion of  
such information with a signature. An implementation could for  
example, not include any of this information and use other means (out  
of band). Obviously a business relationship might determine additional  
criteria beyond the technical specification.

I'm in transit so will look at the linked material later. I't not sure  
I understand the IDREF question. Signature References must hash  
properly, and the signature value verify properly. I'm not sure more  
is necessary but need to understand the question better .

regards, Frederick

Frederick Hirsch
Nokia



On Oct 15, 2009, at 4:09 PM, ext Kai Hendry wrote:

> I had a quick go categorising tests:
> http://dev.w3.org/2006/waf/widgets-digsig/tests/test-suite- 
> unstable.xml
>
> type=syntax syntactic tests
> type=signature Signature value verification
>
> http://lists.w3.org/Archives/Public/public-webapps/2009OctDec/ 
> 0090.html
>
>
>
> I was thinking would it be a worthwhile, to test the widget runtime
> notices that all the signatures have the same IDREF? I don't see the
> MUST for "MUST  use an IDREF value for the ds:Reference  URI
> attribute," in
> http://dev.w3.org/2006/waf/widgets-digsig/tests/ for whatever reason.
>
>
> I need to prepare some tests that check for chaining, see:
> http://wiki.webvm.net/wrtc/qa/
>
> Reading http://www.w3.org/TR/widgets-digsig/ I understand OCSP and
> chaining is entirely optional? So a valid widget runtime that say,
> just verifies the SignatureValue is said to be compliant?
>
>
> Thanks for looking,