W3C

XML Security Working Group Teleconference

26 Mar 2013

Agenda

See also: IRC log

Attendees

Present
Frederick_Hirsch, Scott_Cantor, Bruce_Rich, Pratik_Datta, Gerald_Edgar, Jim_Dovey
Regrets
Chair
Frederick_Hirsch
Scribe
fjh

Contents


<trackbot> Date: 26 March 2013

<scribe> ScribeNick: fjh

Administrative: Agenda review, Announcements.

no announcements

Minutes Approval

Approve minutes from 5 March 2013

http://lists.w3.org/Archives/Public/public-xmlsec/2013Mar/att-0001/minutes-2013-03-05.html

RESOLUTION: Minutes from 5 March 2013 are approved

Charter Status

fjh: On 11 April expect to publish 1.1 Recs, updated WG Notes and all 2.0 drafts as WG Notes
... we need to extend the charter, have message to tlr regarding status of chartering, both for maintenance and XML Normalization
... waiting for feedback and draft from tlr

<scribe> ACTION: tlr to provide draft charter for XML Security maintenance, including XML Normalization, share draft with WG, will this require re-joining? [recorded in http://www.w3.org/2013/03/26-xmlsec-minutes.html#action01]

<trackbot> Created ACTION-936 - Provide draft charter for XML Security maintenance, including XML Normalization, share draft with WG, will this require re-joining? [on Thomas Roessler - due 2013-04-02].

fjh: hopefully this will not require rejoining the WG

XML Normalization

Review and discussion of (revised) XML Normalization draft, see http://www.w3.org/2008/xmlsec/Drafts/xml-norm/Overview.html

<Gerald-E> Zakim Gerald-E is aabb

(includes minor editorial revisions - http://lists.w3.org/Archives/Public/public-xmlsec/2013Mar/0004.html )

fjh: additional comments from Jim - http://lists.w3.org/Archives/Public/public-xmlsec/2013Mar/0007.html

pdatta: I think we can work from the draft Jim produced, so I will not produce a different draft

fjh: we have to decide as a WG our plans for this document before we do more work

scantor: not sure I understand the abstract as to why this makes it simpler and easier to process, when libraries can already handle XML

pdatta: agrees with this concern

scantor: canonicalization not really needed for serialization strategy, not sure needed for parsing, parser can handle input stream despite variations, so trying to understand motivation

jdovey: more for client of parser, not useful for SOAP or XML RPC where endpoints know what to expect, but on ebook side various tools can produce books
... so when processing documents having to check that namespaces are correct and that things are in right order

scantor: that is XML

jdovey: devices are constrained, so want to limit the validation parser has to do
... so would prefer to have string comparisons of prefixes rather than dealing with URLs
... want to simplify handing namespaces for example

scantor: canonicalization does not guarantee prefix values

jdovey: want to normalize the prefixes, similar to sequential namespace numbering as in C14N2

fjh: there are no intermediaries in this case to cause changes to the XML

jdovey: page templates

scantor: you are trying to create a shorthand profile for the structure of the document to avoid building a full parser on the client
... theoretical advantage to have that algorithm re-use c14n algorithm if that algorithm exists or is supported already, but this one does not already, the 2.0 one
... so would you be better off with something more compact or constrained

jdovey: found c14n2 algorithms simple to implement

scantor: QName awareness might be more difficult with not visibly used namespaces, but maybe you are not needing that

jdovey: that is true
... epub CFI we might find XPath useful for CFO use case

fjh: think Jim is trying to cut C14N down to simplify, perhaps we should have an initial simple version

jdovey: might want it extended to other stuff later

scantor: you are trying to define an API here, could define interface to normalization algorithm, allowing other algorithms later

jdovey: trying to define how to use with SAX parser

fjh: not sure I understand why need different test cases from C14N2 test cases, given that the pseudocode is roughly the same

jdovey: have added some new material, also do not output text but modify stream of events, different output
... of course name is confusing as well
... question how namespaces should be output as well, as attributes or only namespace-mapping events

pdatta: not related to security as such, at Oracle we have a different group looking at this, wonder if this should be moved into another WG
... EXI also does some namespace work

fjh: not sure EXI would offer simplicity that would fit into the ePub work

jdovey: agrees

fjh: I can check about XML WG interest in W3C, but assuming this work stays in this WG, what do we think

pdatta: I'm in the security space, not the XML Group, so do not see myself doing interop, but maybe there is someone in that area of Oracle, will check

fjh: at this point you've already done interop on C14N2 and test cases, unless I'm mistaken

pdatta: yes, that is correct, but given that the use cases and goals are different, I anticipate there will be changes, which would make it difficult to revise the testing and complete interop

<scribe> ACTION: fjh to follow up with XML CG about interest and possibility of doing this work in another WG, such as XML Core. [recorded in http://www.w3.org/2013/03/26-xmlsec-minutes.html#action02]

<trackbot> Created ACTION-937 - Follow up with XML CG about interest and possibility of doing this work in another WG, such as XML Core. [on Frederick Hirsch - due 2013-04-02].

fjh: now is good time to check with other W3C XML groups as the chartering is in process
... seems that this WG might not be appropriate as it does not look like it would have adequate participation to complete interop
... but it has provided a useful starting point with C14N2
... I think the goal is to get this done, regardless of where

jdovey: that is ok

pdatta: can you please send email regarding the use cases

jdovey: will have to see what I can share, maybe I can give some examples

fjh: please send to the list

jdovey: ok

fjh: the editorial changes you suggested in your email looked fine to me Jim, not sure worth changing the pseudocode formatting at this point
... want to talk about last question

jdovey: when processing namespaces when become used become attributes on element, but isn't it better to create SAX2 beginNamespaceMapping and endNamespaceMapping events at the point at which they become visibly utilized
... concerned about details of how SAX implementation will work
... would also like to better define details of StAX parsing
... do not want to add items to attribute index when not necessary

<scribe> ACTION: pdatta to share XML Normalization with Oracle XML team to determine interest, especially in interop [recorded in http://www.w3.org/2013/03/26-xmlsec-minutes.html#action03]

<trackbot> Created ACTION-938 - Share XML Normalization with Oracle XML team to determine interest, especially in interop [on Pratik Datta - due 2013-04-02].

fjh: it looks like the consensus of members of this call is that we should not expect this work to progress to Rec in this WG as we may not have the correct participants for interop
... this does not mean that the work should not progress, but it may be more appropriate in another group, or we may need to get other participants in this group
... that said, it probably makes sense to revise the draft to include more detail on the events work, but that is your decision, seems like it would be needed anyway

jdovey: yes I can make this change

fjh: I can help check in the draft, help with CVS etc

Action Review

ACTION-932?

<trackbot> ACTION-932 -- Pratik Datta to produce a C14N1.2 draft for next week -- due 2013-03-12 -- OPEN

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/932

fjh: this no longer is needed, we will work from Jim's draft

close ACTION-932

<trackbot> Closed ACTION-932 Produce a C14N1.2 draft for next week.

ACTION-933?

<trackbot> ACTION-933 -- Frederick Hirsch to help Jim get setup with C14N2 source and editing -- due 2013-03-12 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/933

ACTION-935?

<trackbot> ACTION-935 -- James Dovey to draft use cases and clarifying material for new canonicalization draft -- due 2013-03-12 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/935

ACTION-935: see http://www.w3.org/2008/xmlsec/Drafts/xml-norm/Overview.html

<trackbot> Notes added to ACTION-935 draft use cases and clarifying material for new canonicalization draft.

ACTION-935: Jim will also see if he can share more examples on the list

<trackbot> Notes added to ACTION-935 draft use cases and clarifying material for new canonicalization draft.

close ACTION-935

<trackbot> Closed ACTION-935 draft use cases and clarifying material for new canonicalization draft.

Issue Review

ISSUE-234?

<trackbot> ISSUE-234 -- Reference SP800-56A later in publication process if the latest version is no longer a draft -- open

<trackbot> http://www.w3.org/2008/xmlsec/track/issues/234

Other Business

RESOLUTION: Cancel 2 April 2013 teleconference

no other business

Adjourn

Summary of Action Items

[NEW] ACTION: fjh to follow up with XML CG about interest and possibility of doing this work in another WG, such as XML Core. [recorded in http://www.w3.org/2013/03/26-xmlsec-minutes.html#action02]
[NEW] ACTION: pdatta to share XML Normalization with Oracle XML team to determine interest, especially in interop [recorded in http://www.w3.org/2013/03/26-xmlsec-minutes.html#action03]
[NEW] ACTION: tlr to provide draft charter for XML Security maintenance, including XML Normalization, share draft with WG, will this require re-joining? [recorded in http://www.w3.org/2013/03/26-xmlsec-minutes.html#action01]
 
[End of minutes]

Minutes formatted by David Booth's scribe.perl version 1.135 (CVS log)
$Date: 2009-03-02 03:52:20 $