W3C home > Mailing lists > Public > w3c-ietf-xmldsig@w3.org > July to September 2000

RE: Why isn't KeyInfo inside SignedInfo [Attn: Brian L.]

From: John Boyer <jboyer@PureEdge.com>
Date: Tue, 29 Aug 2000 14:53:00 -0700
To: "Ed Simon" <ed.simon@entrust.com>, "XML DSig" <w3c-ietf-xmldsig@w3.org>
Message-ID: <BFEDKCINEPLBDLODCODKMELHCEAA.jboyer@PureEdge.com>
Actually, it seems it was a no-brainer, as Joseph pointed out to me this
morning (I was rushing out of the door yesterday when someone asked me this
question; that's my excuse and I'm sticking by it!)

If you want to sign it, just add a Reference to it in the SignedInfo.  No
need to cover it with the SignatureValue when we can cover it with a
DigestValue.

John Boyer
Development Team Leader,
Distributed Processing and XML
PureEdge Solutions Inc.
Creating Binding E-Commerce
v: 250-479-8334, ext. 143  f: 250-479-3772
1-888-517-2675   http://www.PureEdge.com <http://www.pureedge.com/>



-----Original Message-----
From: w3c-ietf-xmldsig-request@w3.org
[mailto:w3c-ietf-xmldsig-request@w3.org]On Behalf Of Ed Simon
Sent: Tuesday, August 29, 2000 1:47 PM
To: XML DSig
Subject: RE: Why isn't KeyInfo inside SignedInfo [Attn: Brian L.]


There has been some discussion on this in the past, see
the threads starting at
"http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2000JanMar/0174.html"
and
"http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2000JanMar/0193.html"
for example.

I think though it would be timely if Brian summarized the answer
to the question again.  There has been a lot of traffic on the XML
Encryption
list wondering why KeyInfo isn't signed.

Brian, could you cross-post your answer to XML Encryption please.  If anyone
else would like to respond who's delved into the issue, that would be fine
too.

Ed
----------------------------------------------------------------------------
----------
Ed Simon
Software Engineer, Entrust Technologies
email:  ed.simon@entrust.com
ph: (613) 247-2583
----------------------------------------------------------------------------
----------


-----Original Message-----
From: John Boyer [mailto:jboyer@PureEdge.com]
Sent: Monday, August 28, 2000 8:04 PM
To: XML DSig
Subject: Why isn't KeyInfo inside SignedInfo


This might be a no-brainer at this point, but I just noticed that KeyInfo is
not inside SignedInfo.

Why is this?

It seems that during signature generation, all data within KeyInfo can be
filled in prior to generating the SignatureValue.  The signer chooses his
identity before the SignatureValue is created.

Otherwise, the material in KeyInfo would seem to be largely untrustworthy
even if our signatures validate.  After validation, we would have to dig up
the real information from the actual certificates just to be sure that all
of this identity information wasn't substituted on us by an attacker.

On the other hand, perhaps it is done this way to force application
developers to obtain the information (like subject name) from the
certificate to avoid attacks from those who would generate a faulty
signature.

In which case, why bother breaking this information out into XML?

Thanks,

	 John Boyer
Development Team Leader,
Distributed Processing and XML
PureEdge Solutions Inc.
Creating Binding E-Commerce
v: 250-479-8334, ext. 143  f: 250-479-3772
1-888-517-2675    <http://www.pureedge.com/> http://www.PureEdge.com
Received on Tuesday, 29 August 2000 17:53:01 GMT

This archive was generated by hypermail 2.2.0 + w3c-0.29 : Thursday, 13 January 2005 12:10:11 GMT