W3C home > Mailing lists > Public > w3c-ietf-xmldsig@w3.org > July to September 1999

RE: Minutes from Today's Call Please Review/Correct

From: Phillip M Hallam-Baker <pbaker@verisign.com>
Date: Tue, 24 Aug 1999 11:48:35 -0400
To: "Donald E. Eastlake 3rd" <dee3@torque.pothole.com>
Cc: "IETF/W3C XML-DSig WG" <w3c-ietf-xmldsig@w3.org>
Message-ID: <002201beee48$1fda2a80$6e07a8c0@pbaker-pc.verisign.com>

> >The only argument advanced in favour of C14N has been that some folks 
> >want transmission over channels which introduce noise. On the minus
> 
> That is only true for a very, VERY broad stretched definition of
> "noisy" channel.  Is a 7 bit channel which requires a reservable
> re-encoding into UTF-7 noisy? 

Yes, but that transformation does not require C14N, in fact as I explain
bellow c14N cannot be used in this circumstance.

> Is a system which parses messages into
> DOM trees, re-assebmles various parts of them including some
> signatures into a new message and signs parts of that a "noisy
> channel"?

No, it is noisy AND lossy.

I don't accept that support for either channel should be mandatory. I 
don't believe that supporting the second channel is safe.

I certainly don't accept that sympathy for the first scenario should
be used to justify support for the second.

> As far as I can see, cannonicalization is absolutely essential for a
> vast range of applications of XMLDSIG,

And how does essential for some applications translate into a MANDATORY
requirement?

> So?  This has nothing to do with canonicalization.  Why are you
> confusing the issue with deliberate FUD?

Throwing insults arround and leveling personal attacks at others 
does nothing for your argument, Don. 


The definition of canonicalization is a function f(x) such that
f(x) = f(f(x)).

The requirements of DOM hash are precisely to specify a canonical 
form. What I and others are arguing is that these requirements have
NOTHING to do with transport over channels which corrupt data.

If you have a channel c(x) which only transmits 7 bit characters
then the TYPE of x is 7bit, the type of c(x) is 7bit-> 7bit.

In order to use such a channel with an 8bit signature algorithm you
need a mapping function m(x) whose type will be 7bit -> 8bit.

m(x) cannot POSSIBLY be a canonicalization algorithm since m(x)
cannot be applied to itself without a type violation.


I will accept that it is sensible to choose a syntax for signed XML
that is robust in the presence of 7bit channels. That is a syntax
issue however and not one of transformation. 


> The requiremens, of course, is that you need to be able to verify the
> signature on an object.  Othewise its useless.  

It is a stronger requirement to be able to detect modification of the
data structure that is signed.

Nobody is arguing against support for c14n FOR THOSE APPLICATIONS WHICH
NEED IT.


		Phill
Received on Tuesday, 24 August 1999 11:47:20 GMT

This archive was generated by hypermail 2.2.0 + w3c-0.29 : Thursday, 13 January 2005 12:10:07 GMT