W3C home > Mailing lists > Public > www-xkms@w3.org > December 2004

Re: Again, confusing 8.1

From: Jose Kahan <jose.kahan@w3.org>
Date: Fri, 17 Dec 2004 20:06:29 +0100
To: Ed Simon <edsimon@xmlsec.com>
Cc: "'Stephen Farrell'" <stephen.farrell@cs.tcd.ie>, www-xkms@w3.org
Message-ID: <20041217190629.GO1217@inrialpes.fr>
Ed, Stephen,

See my previous message.

On Fri, Dec 17, 2004 at 11:39:10AM -0500, Ed Simon wrote:

> It seems to me that requiring an XML processor (right?) is going to be
> particularly performance-consuming.  Plus one has to deal with exactly
> what
> "All shared string values are encoded as XML" means.  To me, it means
> that
> the pass phrase MUST be valid XML (eg.
> "<Pass_Phrase xmlns="http://example.com/secrets">my
> <Adjective>little</Adjective>
> <![CDATA[&lt;]]>secret<![CDATA[&gt;]]>!</Pass_Phrase>"

From what I understand, the pass-phrase is never sent on the
clear. We're only sending the base-64 of a MAC computation.
So that should be valid XML.

However, one interesting point from Ed:
> ) or else it is NOT a valid pass phrase, AND, therefore, pass phrase tools
> must be full-fledged XML parsers capable of dealing with potential attacks
> like entity expansion.  There is also a contradiction that if one requires
> conversion to lower-case, one invalidates XML such as that in my example
> because XML names are case-sensitive.  It seems to me the constraints are
> contradictory.
> I think what was originally intended was something like "encode as UTF-8"; I
> expect requiring this would NOT break the interop cases done thus far
> because I would guess no one is trying to use pass phrases that are, in
> themselves, valid XML.

This makes me think that a user could go to any computer or device and
be able to regenerate the MAC in the same way... as if we need to
canonicalize the pass-phrase so that it's always possible to
regenerate the same MAC as needed.

For example, we could say:

Canonicalize the pass-phrase as follows:

- convert the pass phrase to UTF-8
- convert any remaining XML entity into UTF-8 characters

And then:

- apply the MAC algorithm


Received on Friday, 17 December 2004 19:07:14 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 20:31:43 UTC