RE: ISSUE-52 (scantor): Rules for syntax of KeyInfo child elements should be unambiguous [Errata-XML Signature]

Hi Scott,

I have a few questions about this issue you just raised and am hoping you can provide some additional context:

1) What's an SDO?  "Standard definition organization"?  Assuming that's the case, what specific standard that references XMLDSIG is being questioned?

2) Regarding the encoding of X509Data elements, if you look at RFC 5280 (the most recent version of the PKIX RFC for certs and CRLs), technically the cert format is defined just as an ASN.1 structure without a required ASN.1 encoding rule that must be used.  So, I think technically once could express an X.509v3 cert using DER, BER, PER, XER, whatever.  However, certain fields within the X.509v3 cert do have a hard requirement on DER encoding (the signature, in particular, is taken over the DER encoding of the cert's contents, and cert extensions that are expressed as OID/value pairs must DER-encode the value), so as a practical matter everyone uses DER.  But I believe that technically once could choose to BER-encode a cert and it would be a valid X.509v3 production.  So XMLDSIG just says "base64 the encoding" since there isn't a required encoding.

3) Regarding KeyValue, can you expand on what you find confusing?  KeyValue itself does not define directly any elements that require base64 encoding.  The defined subtypes RSAkeyValue and DSAKeyValue all use ds:CryptoBinary to encode their bignum values.  We use ds:CryptoBinary or base64Binary depending on whether leading zero octets are significant (see Section 4.0.1).

Hope that helps,

                                        --bal


-----Original Message-----
From: public-xmlsec-request@w3.org [mailto:public-xmlsec-request@w3.org] On Behalf Of XML Security Working Group Issue Tracker
Sent: Monday, September 15, 2008 8:36 AM
To: public-xmlsec@w3.org
Subject: ISSUE-52 (scantor): Rules for syntax of KeyInfo child elements should be unambiguous [Errata-XML Signature]


ISSUE-52 (scantor): Rules for syntax of KeyInfo child elements should be unambiguous [Errata-XML Signature]

http://www.w3.org/2008/xmlsec/track/issues/52


Raised by: Scott Cantor
On product: Errata-XML Signature

In at least one case (X509Certificate), work in another SDO that references the XML Signature specification is being questioned on the basis of whether or not the syntax of the element is clearly defined or not. For example, it says base64, but doesn't come out and actually say "of what". Is anything other than the DER encoding legal? Etc.

I suggest that all the "by-value" elements for keys and certificates be examined for clarity. Reading the KeyValue text now, I find it unclear regarding the use of base64 as well.

Received on Monday, 15 September 2008 19:20:51 UTC