W3C home > Mailing lists > Public > w3c-ietf-xmldsig@w3.org > October to December 2003

XML DSig Canonicalization Oddities

From: Anders Rundgren <anders.rundgren@telia.com>
Date: Mon, 22 Dec 2003 20:02:54 +0100
Message-ID: <003201c3c8be$35072cf0$401b40d5@arport>
To: <w3c-ietf-xmldsig@w3.org>

Dear List,
After starting to work with XML messages embedding XML signatures
I of course ran into validation problems due to namespace inheritance.
After some "googling" I found the cure and of course it was you guys who
had  made it as well :-)  A bit late in the process, but anyway. :-|
I mean this one: http://www.w3.org/2001/10/xml-exc-c14n# .

Still I'm not 100% sure how this scheme works.  Am I correct
if I say that the existance of the URI above in "CanonicalizationMethod"
limits the outermost scope of name-spaces to the "Signature" element?

Does this also mean that the following is a bad design that will fail
to validate in most implementations:

<my:elem my:xmlns="htpp....">
  <dsig:Signature dsig:xmxns=...>
   <dsig:SignedInfo>
    <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n# ">
      .
      .
  <Object>
     <my:something_defined_in_the_ns_outside_of_Signature.....>
  </Object>
</Signature>
</my:elem>

That is, should you redeclare the the ns associated with "my" _inside: of the
Signature declaration to be compatible with conforming systems?

MC & HNY!

Anders Rundgren
Received on Monday, 22 December 2003 14:08:36 GMT

This archive was generated by hypermail 2.2.0 + w3c-0.29 : Thursday, 13 January 2005 12:10:18 GMT