- From: Frederick Hirsch <Frederick.Hirsch@nokia.com>
- Date: Fri, 16 Oct 2009 14:39:56 +0200
- To: ext Kai Hendry <hendry@aplix.co.jp>
- Cc: Frederick Hirsch <Frederick.Hirsch@nokia.com>, public-mwts <public-mwts@w3.org>, Marcos Caceres <marcosc@opera.com>
Kai yes, OCSP and cert validation is entirely optional, as is inclusion of such information with a signature. An implementation could for example, not include any of this information and use other means (out of band). Obviously a business relationship might determine additional criteria beyond the technical specification. I'm in transit so will look at the linked material later. I't not sure I understand the IDREF question. Signature References must hash properly, and the signature value verify properly. I'm not sure more is necessary but need to understand the question better . regards, Frederick Frederick Hirsch Nokia On Oct 15, 2009, at 4:09 PM, ext Kai Hendry wrote: > I had a quick go categorising tests: > http://dev.w3.org/2006/waf/widgets-digsig/tests/test-suite- > unstable.xml > > type=syntax syntactic tests > type=signature Signature value verification > > http://lists.w3.org/Archives/Public/public-webapps/2009OctDec/ > 0090.html > > > > I was thinking would it be a worthwhile, to test the widget runtime > notices that all the signatures have the same IDREF? I don't see the > MUST for "MUST use an IDREF value for the ds:Reference URI > attribute," in > http://dev.w3.org/2006/waf/widgets-digsig/tests/ for whatever reason. > > > I need to prepare some tests that check for chaining, see: > http://wiki.webvm.net/wrtc/qa/ > > Reading http://www.w3.org/TR/widgets-digsig/ I understand OCSP and > chaining is entirely optional? So a valid widget runtime that say, > just verifies the SignatureValue is said to be compliant? > > > Thanks for looking,
Received on Friday, 16 October 2009 12:41:17 UTC