AW: Enveloped signatures and XPath

Plonk - plonk - plonk

(....peter is trying hard to keep that discussion from popping up every once
in a while....... and fails....)

> Exclusion by id is bad because you identify an element whose content WILL
> NOT BE in the message digest, so if the identified element's content, tag,
> attributes, etc. are changed, then the message digest will not break.

Said in a generic way like you did just now, this is plain wrong.

You said - Simplified - it is bad to exclude X because it is not included.

Then - don't exclude it.

And if you need to control X - like you do in your application - put it into
your application logic and don't lay the burden on a generic signature
system.

Peter