New C14N/1.1 WD and Web Services Policy 1.5 - Framework (ed. copy)

Hello, 

I'm writing on behalf of the XML-Core Working Group. We'd like to bring to
your attention that we have published three C14N related documents and welcome
review to them [1].

Specifically, there is a new Working Draft for C14N/1.1 that takes into
account different issues related to C14N and the evolution of XML core
technologies, including xml:id. 

In parallel, W3C is working on a charter for a new W3C Working Group that
would have task of making an editorial revision of XML Signature to make
mandatory the use of C14N/1.1, thus making it possible to correctly take into
documents that include xml:id attributes. See the related dsig-usage note
[2] and the thread on the w3c-ietf-xmldsig mailing list [3].

In particular, this work should solve the problem you describe in 
Section 4.2 of the recent Editor's Draft for the Web Services Policy 1.5 - 
Framework [4]:

<quote>

/wsp:Policy/(@wsu:Id | @xml:id) 

The identity of the policy expression as an ID within the enclosing XML
document. If omitted, there is no implied value. To refer to this policy
expression, an IRI-reference  MAY be formed using this value per Section
4.2 of WS-Security [WS-Security 2004] when @wsu:Id is used.

The use of xml:id attribute in conjunction with Canonical XML 1.0 is
inappropriate as described in Appendix C of xml:id Version 1.0 [XML ID]
and thus this combination must be avoided (see [C14N 1.0 Note]). For
example, a policy expression identified using xml:id attribute should not
be signed using XML Digital Signature when Canonical XML 1.0 is being used
as the canonicalization method. 

</quote>

You may wish to apply the procedure described in Section 2.2 of the
dsig-usage note [2] to apply a C14N/1.1 transformation. This could help
you avoid having to define an alternate xml:id attribute.

You can send comments related to the C14N drafts to the following
public-archived list:

   www-xml-canonicalization-comments@w3.org

Best regards,

-jose

[1]
http://www.w3.org/2002/02/mid/CF83BAA719FD2C439D25CBB1C9D1D30204ABFCD3@HQ-MAIL4.ptcnet.ptc.com

[2] http://www.w3.org/TR/2006/WD-DSig-usage-20060915/

[3]
http://www.w3.org/2002/02/mid/20060918163151.GO2766@raktajino.does-not-exist.org

[4]
http://dev.w3.org/cvsweb/~checkout~/2006/ws/policy/ws-policy-framework.html?content-type=text/html;charset=utf-8#Policy_Identification

Received on Wednesday, 20 September 2006 15:35:21 UTC