Re: [scap-dev] Broken XML signatures in USGCB datastreams

On 10/22/14, 11:54 PM, "David Solin" <david@joval.org> wrote:
>
>The Java issue does pertain to the built-in support for XMLDSIG.  Here is
>a reference for you:
>http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8017171

Thanks, I'll take a look.

>As for validation being indicated by c14n11, just so you know how this
>crazy idea popped into my head, it came from reading the bullets:
>
>* Attribute values are normalized, as if by a validating processor
>* Default attributes are added to each element

The first bullet is just saying "you do this one thing in the same way
that a validator would", but the second, I suspect, might be referring to
DTDs. It's definitely not referring to XSD, but that's an obvious point of
confusion.

>... which are found in the definition of the term canonical form in
>section 1.1 of the W3C recommendation (http://www.w3.org/TR/xml-c14n11/).
> I am not an attorney, but while
> it certainly doesn't say you have to validate... really, it certainly
>does appear to say you have to validate.

DTD handling is also referred to as validation in the core XML specs.

-- Scott

Received on Thursday, 23 October 2014 13:38:54 UTC