Timestamping was RE: Location volatility of XML

Hi Todd,

I haven't really seen a case where the time/date is not a visible part of a
transaction itself.  Abstracting away from forms, it still seems that if any
XML document, protocol message, etc. needs a time/date stamp, then it should
be included in the XML design of that document, protocol message, etc.
Applying Joseph's increasingly wise words, it doesn't seem necessary to put
another time/date stamp in the signature itself.

It should be further noted that when a signer adds a time/date stamp, be it
in the application XML, the XML for the signature, or the binary signature
blob itself, the time/date is still being set by the signer and cannot be
trusted by the verifier. One can set up a reliable, secure time service, but
under the assumption that the signer is ill-intentioned, the verifier must
still compare the time/date signed by the signer against the time/date that
the XML document is received, performing some sort of application-specific
reality check.

Still, people tend to like time/date stamping, and the Brown draft provides
for this in the Attributes element.

Does this satisfy what you had in mind?

Thanks,
John Boyer
Software Development Manager
UWI.Com -- The Internet Forms Company


-----Original Message-----
From: tog [mailto:todd.glassey@www.meridianus.com]
Sent: Tuesday, July 27, 1999 6:18 PM
To: John Boyer
Cc: Michael E Mcneil
Subject: Re: Location volatility of XML


John, while we are sorting our patent issues out, are you folks interested
in adding a timestamping token spec to the XML arena. My feeling is that we
need one pretty bad and our BERT structure might be a good candidate since
it's in the public domain so top speak under a GNU licenses.

We should start a dialog on this I think.

Todd Glassey
----- Original Message -----
From: John Boyer <jboyer@uwi.com>
To: Joseph M. Reagle Jr. <reagle@w3.org>
Cc: DSig Group <w3c-ietf-xmldsig@w3.org>
Sent: Tuesday, July 27, 1999 4:27 PM
Subject: Location volatility of XML


> A little humour:
>
> As if to underscore the problems that arise with signing a manifest full
of
> XLinks to the resources we really want to validate...
>
> The URL in the XML DSig Requirements document used to indicate the XML
> specification itself is the 'old' one and doesn't work anymore.  So, if
the
> URL were left as-is, and we digitally signed the XML-DSIG requirements,
then
> the signature would not be completely verifiable since the information we
> really care about is what the XML spec says, not where it used to be.  And
> we couldn't change the URL in such documents to point to the new location
> without breaking the signature.
>
> The URL should be changed to :  http://www.w3.org/TR/1998/REC-xml-19980210
>
> John Boyer
> Software Development Manager
> UWI.Com -- The Internet Forms Company
>
>
>

Received on Wednesday, 28 July 1999 13:49:13 UTC