[ACTION-16] ... proposal regarding use of transform that has parameter for passing xml model

Dear all,

Some steps that - taking a first quick approach - could be sufficient to
make sure an enveloping signature V2 may respect the following order for
streaming processing:

1. Algorithms
2. Data
3. DigestValues and SignatureValues

Here is a quickly drafted proposal about how this could be achieved
using the current XMLDSIG syntax:

* create a reference that points to the data (the first child of a
specific transform), the URI SHOULD be supplied for compatibility.

e.g. URI =
"#xmlns(ds=http://www.w3.org/2000/09/xmldsig#)xpointer(here()/ancestor::ds:Reference/ds:Transforms[1]/ds:Transform[1]/InlineXML[1]/child::node()[not(self::text())])"

* supply the data as a child of the first transform that is supposed to
be ignored by old applications and shall return the data contained as
its first child.

e.g. Algorithm="http://www.w3.org/2008/08/xmldsig#supply-data-transform"

* [optional] make sure it is not digested twice (ds:Reference Level &
ds:SignedInfoLevel, optional because the interpretation of conflicting
double digesting may be difficult in some legal frameworks)

e.g.
Algorithm="http://www.w3.org/2008/08/xml-exc-c14n12#SkipDataTransform"
(maybe use for forwards compatibility)

the only means we have for that is the ds:SignedInfo Level c14n, ...


Konrad

a draft example often says more than thousand words.

<Signature Id="MyStreamingEnvelopingSignature"
xmlns="http://www.w3.org/2000/09/xmldsig#">
  <SignedInfo>
    <CanonicalizationMethod
Algorithm="http://www.w3.org/2008/08/xml-exc-c14n12#SkipDataTransform"/>
    <SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
    <Reference
URI="#xmlns(ds=http://www.w3.org/2000/09/xmldsig#)xpointer(here()/ancestor::ds:Reference/ds:Transforms[1]/ds:Transform[1]/InlineXML[1]/child::node()[not(self::text())])">

      <Transforms>
        <Transform
Algorithm="http://www.w3.org/2008/08/xmldsig#supply-data-transform">
          <InlineXML xmlns="" xmlns:ds="" ... further undeclarations ...
xmlns:*=""><!-- no space allowed/interpreted here
--><MyData></MyData><!-- no space allowed/interpreted
 here --></InlineXML>
        </Transform>
      </Transforms>
      <DigestMethod
Algorithm="http://www.w3.org/2001/04//xmlenc/#/sha256/"/>
      <DigestValue>dGhpcyBpcyBub3QgYSBzaWduYXR1cmUK.../DigestValue>
    </Reference>
  </SignedInfo>
  <SignatureValue>...</SignatureValue>
  <KeyInfo>
    <KeyValue>
      <DSAKeyValue>
        <P>...</P><Q>...</Q><G>...</G><Y>...</Y>
      </DSAKeyValue>
    </KeyValue>
  </KeyInfo>
</Signature>


-- 
Konrad Lanz, IAIK/SIC - Graz University of Technology
Inffeldgasse 16a, 8010 Graz, Austria
Tel: +43 316 873 5547
Fax: +43 316 873 5520
https://www.iaik.tugraz.at/aboutus/people/lanz
http://jce.iaik.tugraz.at

Certificate chain (including the EuroPKI root certificate):
https://europki.iaik.at/ca/europki-at/cert_download.htm