XML Security Working Group Teleconference

<trackbot> Date: 01 March 2011

<fjh> ScribeNick: brich

Administrative

<tlr> regrets for next week

<fjh> CR Transition request: http://lists.w3.org/Archives/Member/member-xmlsec/2011Feb/0015.html

fjh: Meeting on 15 March canceled

<fjh> Canonicalization help request

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2011Feb/0029.html

RESOLUTION: Cancel teleconference on 15 March 2011

Minutes Approval

<fjh> Approve minutes, 15 February 2011

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2011Feb/att-0028/minutes-2011-02-15.html

RESOLUTION: Minutes from 15 February 2011 are approved

XML Security 2.0

pdatta: issue with URI with or without fragment identifier and XPATH

fjh: seems like having fragment is valuable

<fjh> can have includedXpath if URI is "" for same document or URI for external document, but not if using fragment identifier

<fjh> Roadmap has planned publication by end of March, http://www.w3.org/2008/xmlsec/wiki/Roadmap

fjh: should we focus on examples by Meiko, even though partial?

meiko: examples are outdated, need rework

fjh: perhaps some SOAP examples for Sig 2.0, Hal to think about action
... focus on what we need for last call

<fjh> ACTION-476?

<trackbot> ACTION-476 -- Frederick Hirsch to review xml signature 2.0 -- due 2011-01-20 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/476

<fjh> ACTION-717?

<trackbot> ACTION-717 -- Pratik Datta to document the Performance improvements with 2.0 -- due 2010-11-09 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/717

<fjh> ACTION-732?

<trackbot> ACTION-732 -- Frederick Hirsch to add example to signature 2.0 once Meiko shares text on list, see ACTION-711 -- due 2011-01-20 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/732

<fjh> ACTION-753?

<trackbot> ACTION-753 -- Scott Cantor to work on creating 2.0 example for Signature 2.0 -- due 2010-12-21 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/753

<fjh> ACTION-769?

<trackbot> ACTION-769 -- Pratik Datta to add note to XML SIgnature to clarify use of id with URI versus XPath -- due 2011-01-18 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/769

<fjh> ACTION-772?

<trackbot> ACTION-772 -- Scott Cantor to add wording about using IncludedXPath in favor of PositionAssertion -- due 2011-01-25 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/772

<fjh> ACTION-773?

<trackbot> ACTION-773 -- Pratik Datta to update signature 2.0 related to id and XPath -- due 2011-02-01 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/773

<fjh> ACTION-774?

<trackbot> ACTION-774 -- Pratik Datta to apply ID/IncludedXPath change to additional selection type -- due 2011-02-15 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/774

<fjh> ACTION-775?

<trackbot> ACTION-775 -- Pratik Datta to research XPath 1 vs 2 differences -- due 2011-02-15 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/775

pdatta: sent message re 775

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2011Feb/0031.html

pdatta: do we want to retain the 1.0 support whilst supporting 2.0?
... may be hard to accomplish

fjh: want to use profile without saying whether 1.0 or 2.0, in ideal case

pdatta: datatypes via schema are problemmatic

<scantor> I don't think we should be making things "not work" with XML Schema, as opposed to not requiring it.

pdatta: a streaming xpath processor today would be done on xpath2.0, not on old 1.0

fjh: wonders how broad the support for xpath2.0 really is

<fjh> "This document has been jointly developed by the W3C http://www.w3.org/Style/XSL/ and the W3C http://www.w3.org/XML/Query/, each of which is part of the http://www.w3.org/XML/Activity."

<fjh> http://www.w3.org/TR/xpath20/

<tlr> also... http://www.w3.org/TR/xpath-30/

fjh: see a schedule risk in changing to XPath 2.0 - we should anticipate a slip to the schedule as we will need time to make sure this change is done correctly

pdatta: this would take some time to get right, more reviews

tlr: wonders if we didn't have this discussion at TPAC

fjh: thinks that XPath1.0 was acceptable, according to TPAC discussion

pdatta: got internal feedback about 1.0 only as not good enough

hal: will xpath3.0 presume that schema is always available?

<fjh> we are discussing XPath 2.0 since Pratik got feedback from implementers regarding creating a new streaming implementation, that using XPath 2 rather than 1 for a new implementation is appropriate to enable use of existing code. Thus this is a possible new requirement based on adoption considerations.

<tlr> http://www.w3.org/TR/xpath-30/

hal: may be able to sidestep content comparisons

<tlr> also, I got confused. xpath 3 is the next iteration

tlr: xpath2 is a rec, xpath3 is a working draft

<fjh> ACTION: fjh to ask xml cg about xpath 1, 2, 3 [recorded in http://www.w3.org/2011/03/01-xmlsec-minutes.html#action01]

<trackbot> Created ACTION-776 - Ask xml cg about xpath 1, 2, 3 [on Frederick Hirsch - due 2011-03-08].

<fjh> can xml signature be agnostic of xpath version

<fjh> is there an issue of whether xml schema is required or not for XPath 2?

hal: think at worst we end up with a false negative on Signature

<fjh> ACTION: fjh to check with Magnus re Microsoft and streaming implementation, XPath version choice [recorded in http://www.w3.org/2011/03/01-xmlsec-minutes.html#action02]

<trackbot> Created ACTION-777 - Check with Magnus re Microsoft and streaming implementation, XPath version choice [on Frederick Hirsch - due 2011-03-08].

pdatta: schema is biggest issue with xpath profile

<fjh> if we change the XPath profile to use XPath 2.0, then does C14N2 also require changes?

<Hal> we could consider indicating in thtadata whether the sender used a schema or not

pdatta: think xpath would be used without predicates most frequently, may be able to warn in specification that communicating parties need to agree out of band whether or not schema is used, required
... c14n2 does not refer to nodesets, so not dependent on xpath profile decisions

hal: goal is to work with 2.0 processors, but not necessarily to enable new operations

<fjh> ACTION: pdatta to propose changes to the XPath profile related to using XPath 2.0 [recorded in http://www.w3.org/2011/03/01-xmlsec-minutes.html#action03]

<trackbot> Created ACTION-778 - Propose changes to the XPath profile related to using XPath 2.0 [on Pratik Datta - due 2011-03-08].

Interop and test cases

<fjh> Generic Hybrid Cipher test cases and interop

<fjh> XML Signature 1.1 and XML Encryption 1.1 interop

fjh: don't have testcases for these

<fjh> XML Security 2.0 interop

fjh: no F2F planned
... soliciting input on need for F2F for interop?
... volunteers for review of current tests?

<fjh> Need to outline missing test cases for specs and plan for interop.

<fjh> ACTION: gerald to review test cases for 1.1 and summarize which are missing [recorded in http://www.w3.org/2011/03/01-xmlsec-minutes.html#action04]

<trackbot> Created ACTION-779 - Review test cases for 1.1 and summarize which are missing [on Gerald Edgar - due 2011-03-08].

Issue reviews

<fjh> ISSUE-219?

<trackbot> ISSUE-219 -- Status of Reference Type attribute in 2.0? -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/219

<fjh> ISSUE-220?

<trackbot> ISSUE-220 -- Clarify handling of comments and processing instructions in 2.0 mode , currently in terms of C14N -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/220

<fjh> ISSUE-222?

<trackbot> ISSUE-222 -- Review URI definitions in Signature 2.0 , also consider indicating usage in URI, e.g. /transforms -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/222

<fjh> ISSUE-224?

<trackbot> ISSUE-224 -- why is base64 listed in algorithms section, is this for transform? where is it described in document, and does this belong in 1.1 or 2.0 mode. -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/224

<fjh> ACTION: fjh to bring base64 work forward to 2.0, ISSUE-224 [recorded in http://www.w3.org/2011/03/01-xmlsec-minutes.html#action05]

<trackbot> Created ACTION-780 - Bring base64 work forward to 2.0, ISSUE-224 [on Frederick Hirsch - due 2011-03-08].

<fjh> ISSUE-225?

<trackbot> ISSUE-225 -- Whether to ignore xml:space and relationship to TrimTextNodes -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/225

<fjh> ISSUE-226?

<trackbot> ISSUE-226 -- What protection is gained by the <dsig2:IDAttributes> element? -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/226

<fjh> ISSUE-226 closed

<trackbot> ISSUE-226 What protection is gained by the <dsig2:IDAttributes> element? closed

<fjh> ISSUE-220?

<trackbot> ISSUE-220 -- Clarify handling of comments and processing instructions in 2.0 mode , currently in terms of C14N -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/220

<fjh> ISSUE-220: we ignore processing instructions, allow with or without comments

<trackbot> ISSUE-220 Clarify handling of comments and processing instructions in 2.0 mode , currently in terms of C14N notes added

<fjh> ISSUE-220: processing instructions are always included, document clear

<trackbot> ISSUE-220 Clarify handling of comments and processing instructions in 2.0 mode , currently in terms of C14N notes added

<fjh> ISSUE-220: closed

<trackbot> ISSUE-220 Clarify handling of comments and processing instructions in 2.0 mode , currently in terms of C14N notes added

<fjh> ISSUE-220 closed

<trackbot> ISSUE-220 Clarify handling of comments and processing instructions in 2.0 mode , currently in terms of C14N closed

Other business

fjh: Reminder to please review issues and discuss on list, also complete actions. We will have call next week, no call 15 March.