W3C

XML Security Working Group Teleconference

14 Dec 2010

Agenda

See also: IRC log

Attendees

Present
fjh, Ed_Simon, Gerald-E, Thomas, magnus, cynthia, +1.614.292.aaaa, scantor, +1.512.401.aabb, brich, pdatta, mjensen, Frederick_Hirsch, Cynthia_Martin, Gerald_Edgar, Scott_Cantor, CynthiaMartin, ThomasRoessler, Magnus_Nystrom, Bruce_Rich, Pratik_Datta, Meiko_Jensen
Regrets
Shivaram_Mysore
Chair
Frederick_Hirsch
Scribe
Gerald-E

Contents


<trackbot> Date: 14 December 2010

<fjh> ScribeNick: Gerald-E

Administrative Topics

<fjh> updated 2.0 requirements draft (ACTION-744), http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0044.html

<fjh> EXI Last Call comments closed, http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0054.html

<fjh> Response to Sampo re Exclusive C14N concerns

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0055.html

<tlr> regrets for next week

<fjh> Call scheduled for next week, 21 Dec, no call 28 December

<Cynthia> I will be here next week

I will be here..

fjh: We will have a call next week

<fjh> Update on ECC

tlr: a new line of communications with Certicom and we will have more discussions early next year.

Minutes approval

<fjh> Approve minutes, 7 December 2010

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/att-0043/minutes-2010-12-07.html

RESOLUTION: Minutes from 7 December 2010 are appoved

XPath Profile

<fjh> Further Changes to Xpath profile for XML Signature

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0050.html

<fjh> ACTION-689?

<trackbot> ACTION-689 -- Pratik Datta to limit to xpath profile during xml signature 2.0 generation in 2.0 mode -- due 2010-11-08 -- CLOSED

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/689

Pratik: there is a complete grammar in three parts. Making it easier to read

<fjh> discussion item, Interaction between ID and XPath for XML Signature 2.0 Selection ACTION-737

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0052.html

fjh: some poeple want to use somthing simpler than XPath

Scott: he was hoping to provide an ID based solution without XPath

<fjh> scott was hoping for ID based with simple exclusions

Scott: he wants to use a comstrained subset with IDs

<fjh> scott concerned that not everyone will be streaming

Scott: if the use of the XPath model is not streamable we have to look at options.

fjh: the issue is to use the context or the root.

<scantor> so you could use ID signing plus ExcludedXPath using the descendant axis (//saml:Advice)

fjh: option one might work with exclusions.

Scott: he can live with option one.

fjh: resolve to go with Option one

<fjh> pdatta notes option 1 avoids potential issue of id() not working properly in some cases

<fjh> scantor also allows only 1 id

Scott: He is willing to make the change

<fjh> proposed RESOLUTION: Accept Option 1 proposed for ACTION-737

<fjh> ACTION: pdatta to update XPath profile for Option 1 in proposal associated with ACTION-737 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action01]

<trackbot> Created ACTION-747 - Update XPath profile for Option 1 in proposal associated with ACTION-737 [on Pratik Datta - due 2010-12-21].

Pratik: we will have to chnge the XPath profile

RESOLUTION: Accept Option 1 proposed for ACTION-737

<pdatta> currently id()//saml:Advice is supported in XPath profile, but we can remove it

<fjh> ACTION: scantor to update XML Signature 2.0 for Option 1 as proposed for ACTION-737 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action02]

<trackbot> Created ACTION-748 - Update XML Signature 2.0 for Option 1 as proposed for ACTION-737 [on Scott Cantor - due 2010-12-21].

<fjh> ACTION-728?

<trackbot> ACTION-728 -- Pratik Datta to send summary of differences of xslt and xml security streamability and XPath profiling to list -- due 2010-11-23 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/728

XML Signature 2.0

<fjh> ACTION-740?

<trackbot> ACTION-740 -- Scott Cantor to provide proposal for change to selection section use of type/subtype, algorithm usages -- due 2010-12-14 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/740

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0046.html

<fjh> proposed RESOLUTION: replace Type/Subtype with Algorithm in selection algorithms

fjh: subtype is part of the algorithm

Scott: for URIs there is a name but not a type.
... as we add algorithms we increase the chance to have a conflict

<fjh> ISSUE: review URI definitions in Signature 2.0 , also consider indicating usage in URI, e.g. /transforms

<trackbot> Created ISSUE-222 - Review URI definitions in Signature 2.0 , also consider indicating usage in URI, e.g. /transforms ; please complete additional details at http://www.w3.org/2008/xmlsec/track/issues/222/edit .

proposed RESOLUTION: Accept the proposal for algorithm and placement from ACTION-740 from Scott.

RESOLUTION: Accept the proposal for algorithm and placement from ACTION-740 from Scott

<fjh> ISSUE-222: rationale is to avoid inadverent duplications

<trackbot> ISSUE-222 Review URI definitions in Signature 2.0 , also consider indicating usage in URI, e.g. /transforms notes added

Optional and Mandatory

fjh: to remove algorithms and make it a seperate document
... for 2.0 there is a concern about interoperability.

Scott: making things optional may make for interoperability problems.

fjh: there could be a transition period from one version of the standard to another.

Pratik: we will have to support 1.0 for a long time

tlr: a way to frame this is to say as of 2.0 the implementation must support the new model with the old model being optional, but for full interoperaility the old model must be impleemnted too.

fjh: we could make it optional for compatibility mode

<fjh> proposed RESOLUTION: Add conformance section, indicating both conformance for 2.0 and/or compatibility mode, and list of what is required when mode is supported. Make 2.0 mode required and compatibility mode optional

<Cynthia> I agree with the text move

RESOLUTION: Add conformance section, indicating both conformance for 2.0 and/or compatibility mode, and list of what is required when mode is supported. Make 2.0 mode required and compatibility mode optional

<fjh> ACTION: fjh to create conformance section and move 6.1 material to it [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action03]

<trackbot> Created ACTION-749 - Create conformance section and move 6.1 material to it [on Frederick Hirsch - due 2010-12-21].

<fjh> ACTION-741?

<trackbot> ACTION-741 -- Scott Cantor to summarize schema issues with Verification elements -- due 2010-12-14 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/741

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0047.html

Scott: suggesting change so it looks more like the rest of the spec

<mjensen> +1 for type attribute

<fjh> pdatta notes using Type enables extensions to the verification element

scott: people would not need XML extention but to use type extention.

Proposed RESOLUTION: result of Action 741 is accepted

<fjh> ACTION: scantor to implement change to schema and document for Verification element proposal as noted in message 47 for ACTION-741 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action04]

<trackbot> Created ACTION-750 - Implement change to schema and document for Verification element proposal as noted in message 47 for ACTION-741 [on Scott Cantor - due 2010-12-21].

<fjh> proposed RESOLUTION: proposal for ACTION-741 accepted

RESOLUTION: proposal for ACTION-741 accepted

<fjh> ACTION-742?

<trackbot> ACTION-742 -- Scott Cantor to propose text regarding 6.7.1.1 and use of c14n2 -- due 2010-12-14 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/742

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0048.html

Scott: c14n2 could include the inherited space for other algorithms to use.

<fjh> proposed RESOLUTION: Accept proposal associated with ACTION-742

fjh: this leaves a lot of the decion making to the implementor

Scott: he is not touching XML Base
... is adding XML Lang OK?

fjh: some issues with the architecture and uniform support for it

<fjh> ISSUE: requirement to "respect XML architecture" may lead to issue related to simplification and vs need to implement

<trackbot> Created ISSUE-223 - Requirement to "respect XML architecture" may lead to issue related to simplification and vs need to implement ; please complete additional details at http://www.w3.org/2008/xmlsec/track/issues/223/edit .

<fjh> note that preprocessing might be possible with XML Base

Scott: XML Base it the only one wish the problem
... you can allow arbitrary c14n or you do not.

RESOLUTION: Accept proposal associated with ACTION-742

<fjh> ACTION: scantor to implement change for ACTION-742 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action05]

<trackbot> Created ACTION-751 - Implement change for ACTION-742 [on Scott Cantor - due 2010-12-21].

Separation of material from XML Signature 2.0

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0057.html

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0049.html

fjh: Should we start to pull things apart? but this may make for confusion because we have more docs
... we could have the 2.0 materials first, and then have the earlier material separate

Scott: to pull out the 1.x materials to make it seperate
... to leave the top level materials and make a section 7 addressing compatability mode

fjh: anything not applicable to 2.0 is in a new section.
... this would reduce the changes we will have to make

<fjh> should move selection element section, 6.7.1 up one level, peer to verification element etc

<fjh> proposal is to add new compatibility mode section, move all material that is compatibility mode specific to that section, including processing rules, transforms , compatibility mode algorithms etc

<fjh> proposed RESOLUTION: move compatibility mode specific material to new section

<fjh> proposed RESOLUTION: move compatibility mode specific material to new section, make section stand-alone

Scott: this should be as standalone as possable. As much as 1.1 as possable.

RESOLUTION: move compatibility mode specific material to new section, make section stand-alone

<fjh> ACTION: scantor to implement change to move compatibility material to new section [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action06]

<trackbot> Created ACTION-752 - Implement change to move compatibility material to new section [on Scott Cantor - due 2010-12-21].

<fjh> agree with need to change 2.0 stuff to be stand-alone, not written as diff to 1.1

Examples for signature 2.0

fjh: what are we trying to show with the examples?

Scott: we need to provide a better example

<fjh> ACTION: scantor to work on creating 2.0 example for Signature 2.0 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action07]

<trackbot> Created ACTION-753 - Work on creating 2.0 example for Signature 2.0 [on Scott Cantor - due 2010-12-21].

Wrapping Attack

<fjh> "Once Pratik's Algorithm for extracting prefixes from XPaths and treating them as "visibly utilized" is put to the spec

Pratik: it is not added yet

<fjh> ACTION-548?

<trackbot> ACTION-548 -- Ed Simon to ed to review XPath Profile -- due 2010-04-20 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/548

<fjh> ACTION-619?

<trackbot> ACTION-619 -- Ed Simon to review Meiko proposal for ACTION-538 -- due 2010-08-03 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/619

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Dec/0005.html

<fjh> ACTION-706?

<trackbot> ACTION-706 -- Scott Cantor to propose definition section text for Included/ExcludedXPath elements for XML Signature 2.0 -- due 2010-11-09 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/706

Best Practices

<fjh> ACTION-716?

<trackbot> ACTION-716 -- Meiko Jensen to propose text for xpath and best practices -- due 2010-11-09 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/716

thanks.. bye all.

Summary of Action Items

[NEW] ACTION: fjh to create conformance section and move 6.1 material to it [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action03]
[NEW] ACTION: pdatta to update XPath profile for Option 1 in proposal associated with ACTION-737 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action01]
[NEW] ACTION: scantor to implement change for ACTION-742 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action05]
[NEW] ACTION: scantor to implement change to move compatibility material to new section [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action06]
[NEW] ACTION: scantor to implement change to schema and document for Verification element proposal as noted in message 47 for ACTION-741 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action04]
[NEW] ACTION: scantor to update XML Signature 2.0 for Option 1 as proposed for ACTION-737 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action02]
[NEW] ACTION: scantor to work on creating 2.0 example for Signature 2.0 [recorded in http://www.w3.org/2010/12/14-xmlsec-minutes.html#action07]
 
[End of minutes]

Minutes formatted by David Booth's scribe.perl version 1.135 (CVS log)
$Date: 2009-03-02 03:52:20 $