W3C

XML Security Working Group Teleconference

21 Feb 2012

Agenda

See also: IRC log

Attendees

Present
Frederick_Hirsch, Scott_Cantor, Gerald_Edgar, Pratik_Datta, Bruce_Rich, Hal_Lockhart
Regrets
Chair
Frederick_Hirsch
Scribe
fjh

Contents


<trackbot> Date: 21 February 2012

<scribe> ScribeNick: fjh

Administrative

No announcements. PAG continues with an additional meeting this Friday.

Minutes Approval

Approve minutes, 24 January 2012

http://lists.w3.org/Archives/Public/public-xmlsec/2012Jan/att-0025/minutes-2012-01-24.html

RESOLUTION: Minutes from 24 January 2012 are approved

Additional CR transitions

"XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" has finished Last Call with no comments.

proposed RESOLUTION: Publish "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" as CR on 28 February (or later if necessary) with CR ending no earlier than 30 days after (i.e. 15 April 2012), no features at risk, and exit criteria of at least two interoperable implementations.

proposed RESOLUTION: Publish "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" as CR on 8 March 2012 with CR ending no earlier than 30 days after (i.e. 20 April 2012), no features at risk, and exit criteria of at least two interoperable implementations.

RESOLUTION: Publish "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" as CR on 8 March 2012 with CR ending no earlier than 30 days after (i.e. 20 April 2012), no features at risk, and exit criteria of at least two interoperable implementations.

Also completed Last Call of XML Encryption 1.1 with no comments other than a minor editorial typo fix

fjh: should we move XML Encryption 1.1 forward to CR or do we need to make additional changes related to algorithms

scantor: I am not planning to implement GCM and there isn't general support in toolkits

fjh: concern with security risk

scantor: could specify as a separate document
... concern that JSON will diverge, not having GCM as mandatory to implement algorithm, but alternative

fjh: adding a non GCM MAC+CBC algorithm could be as a separate document, if non-normative, http://lists.w3.org/Archives/Public/public-xmlsec/2012Feb/0009.html

<scribe> ACTION: scantor to check with John Bradley re JSON plans re MAC+CBC [recorded in http://www.w3.org/2012/02/21-xmlsec-minutes.html#action01]

<trackbot> Created ACTION-870 - Check with John Bradley re JSON plans re MAC+CBC [on Scott Cantor - due 2012-02-28].

scantor: adoption is probably important, may wish to check whether we have algorithms in XML Encryption that are compatible with JSON work

fjh: Given the need for the PAG to conclude as well as the need to complete interop on existing material, there does not seem to be a reason we cannot add an item to XML Encryption and have another Last Call
... possible concern if it is mandatory, optional should not be a problem

<scribe> ACTION: fjh to check with Microsoft regarding plans for JSON [recorded in http://www.w3.org/2012/02/21-xmlsec-minutes.html#action02]

<trackbot> Created ACTION-871 - Check with Microsoft regarding plans for JSON [on Frederick Hirsch - due 2012-02-28].

fjh: defer processing of "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" CR until we resolve plans for XML Encryption 1.1, so we can do both together

pdatta: better to put in spec now

fjh: +1
... more confusing to have separate document

Interop

http://lists.w3.org/Archives/Public/public-xmlsec/2012Feb/0015.html

pdatta: Oracle has not completed Key Derivation interop since were planning to do as part of XML Encryption 1.1

brich: IBM has completed interop for Key Derivation
... could contribute 1.1 test vectors but this would be pending PAG status

<scribe> ACTION: gerald-e to update interop status tables to reflect additional tests that need to be added [recorded in http://www.w3.org/2012/02/21-xmlsec-minutes.html#action03]

<trackbot> Sorry, couldn't find user - gerald-e

ACTION-872?

<trackbot> ACTION-872 -- Gerald Edgar to update interop status tables to reflect additional tests that need to be added -- due 2012-02-28 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/872

ACTION-862?

<trackbot> ACTION-862 -- Hal Lockhart to review FIPS and RSA-OAEP question in http://lists.w3.org/Archives/Public/public-xmlsec/2011Dec/0001.html -- due 2011-12-20 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/862

ACTION-862: http://lists.w3.org/Archives/Public/public-xmlsec/2012Feb/0000.html

<trackbot> ACTION-862 Review FIPS and RSA-OAEP question in http://lists.w3.org/Archives/Public/public-xmlsec/2011Dec/0001.html notes added

ACTION-862 closed

<trackbot> ACTION-862 Review FIPS and RSA-OAEP question in http://lists.w3.org/Archives/Public/public-xmlsec/2011Dec/0001.html closed

hal: summary is that ok

http://lists.w3.org/Archives/Public/public-xmlsec/2012Feb/0002.html

ACTION-865?

<trackbot> ACTION-865 -- Frederick Hirsch to contact parties re participation in interop for 2.0 -- due 2011-12-20 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/865

fjh: I can use help with this

ACTION-866?

<trackbot> ACTION-866 -- Scott Cantor to review XML Encryption 1.1 for schema and text description consistency and clarity -- due 2012-01-24 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/866

ACTION-867?

<trackbot> ACTION-867 -- Frederick Hirsch to review XML Encryption 1.1 for schema and text description consistency and clarity -- due 2012-01-24 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/867

action-868 closed

<trackbot> ACTION-868 Raise RFC 6476 with magnus closed

action-869 closed

<trackbot> ACTION-869 Contact Brian/Magnus re 1.1 interop closed

Other business

RESOLUTION: Teleconference on 20 March cancelled.

Adjourn

Summary of Action Items

[NEW] ACTION: fjh to check with Microsoft regarding plans for JSON [recorded in http://www.w3.org/2012/02/21-xmlsec-minutes.html#action02]
[NEW] ACTION: gerald-e to update interop status tables to reflect additional tests that need to be added [recorded in http://www.w3.org/2012/02/21-xmlsec-minutes.html#action03]
[NEW] ACTION: scantor to check with John Bradley re JSON plans re MAC+CBC [recorded in http://www.w3.org/2012/02/21-xmlsec-minutes.html#action01]
 
[End of minutes]

Minutes formatted by David Booth's scribe.perl version 1.135 (CVS log)
$Date: 2009-03-02 03:52:20 $