W3C home > Mailing lists > Public > public-xmlsec@w3.org > December 2011

[widgets] How to divorce widgets-digsig from Elliptic Curve PAG?

From: Arthur Barstow <art.barstow@nokia.com>
Date: Tue, 13 Dec 2011 13:14:30 -0500
Message-ID: <4EE79606.2030900@nokia.com>
To: Frederick Hirsch <frederick.hirsch@nokia.com>, Thomas Roessler <tlr@w3.org>, Marcos Caceres <marcosscaceres@gmail.com>, Doug Schepers <schepers@w3.org>, Philippe Le Hégaret <plh@w3.org>, Rigo Wenning <rigo@w3.org>, public-webapps <public-webapps@w3.org>, "public-xmlsec@w3.org" <public-xmlsec@w3.org>
Hi All,

The Widgets DigSig spec [W-DigSig] has been sitting in PR for over 4 
months now, blocked on the Elliptic Curve PAG [ECC-PAG]. AFAICT, this 
PAG has just started its unspecified length Fishing Expedition seeking 
some unspecified level of funds to pay for some type of analysis that 
will take some unknown amount of time to complete ...

Given this, and not wanting to block on the ECC PAG any longer, what are 
the options to move widgets-digsig to REC ASAP?

Some options:

1. Replace [XMLSig1.1] dependency with XMLSig 1.0. I presume this would 
require a new 3-week LC but the CR could be zero-length, presumably no 
re-testing would be required, and the only thing blocking PR->REC is the 
length of the new CfE that would be needed.

2. Move the tainted algorithm(s) in XMLSig1.1 to XMLSig1.Next so 
XMLSig1.1 is not affected by the PAG and XMLSig1.1 can then continue on 
the REC track.

3. Others?

(#2 seems dead simple so I'm probably missing some things.)


[W-DigSig] http://www.w3.org/TR/widgets-digsig/
[XMLSig1.1] http://www.w3.org/TR/xmldsig-core1/
[ECC-PAG] http://www.w3.org/2011/02/xmlsec-pag-charter.html
Received on Tuesday, 13 December 2011 18:15:25 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:55:17 UTC