Re: [widgets] Jar signing vs. XML signatures

On 14 Apr 2009, at 10:27, Henri Sivonen wrote:

> Wouldn't it be simpler to use jar signing instead of inventing a new  
> way of signing zip files with implementation dependencies on XML  
> signatures and spec dependencies on XSD? (Why does the spec have  
> dependencies on XSD?)

Which XSD dependency do you mean?  The only XSD dependencies I could  
think of right now are ones that say things like "the value of this  
attribute is of type anyURI" or "the value space of this element is a  
restriction on the base64Binary XSD type."  XML Signature does not  
require schema validation, or anything like that.

> When you need to reserialize XML, you import all the troubles of  
> serializing XML (see e.g. https://issues.apache.org/bugzilla/buglist.cgi?query_format=advanced&product=Security&component=Canonicalization&cmdtype=doit 
>  ).

The only place where you actually need canonicalization is when  
hashing the SignedInfo element inside the signature file (i.e., once  
per signature verification).

Given that the signature format is profiled down pretty heavily in the  
widget signing spec, I'd dare a guess that most of the complexity  
isn't ever used, so a careful implementation might be able to write a  
c14n implementation that bails out on anything that doesn't look like  
a signature that follows the constraints in this format.

Received on Tuesday, 14 April 2009 08:57:39 UTC