Canonicalization: Effect on XSL stylesheets and legal implicatio ns

I've got a bit of a brain dump that I would like to leave you with before I
disappear for a couple of days...

I would expect that in many applications, the validity and usefulness of a
digital signature from a LEGAL
perspective will require capturing not only the content of the XML source
but also its presentation to
the user.  In many cases, this presentation will be defined by an XSL (or
CSS) stylesheet.

XSL enables the presentation of any part of an XML instance including the
processing instructions and
comments.  Offhand, I think it would be highly questionable to put pertinent
legally-binding information
in a processing instruction or comment but we may need to unambiguously
state
the following requirements for application designers who are creating
XML-based applications
that use XML digital signatures:

1.  Applications SHOULD NOT include legally-pertinent information in the
processing instructions or
comments of an XML instance.

2.  If the legal value of a signed XML document is dependent upon how it was
presented through a
stylesheet, that stylesheet MUST be signed too.

3.  If the canonical form of an XML instance is being signed, the XSL
stylesheet associated with that
instance MUST NOT include matches on processing instructions or comments.
(Doing so could cause
the user to agree to information that is not being signed.)

Under the current canonicalization proposal, processing instructions
disappear.  Because the W3C
Recommendation for linking a stylesheet with an XML document
("http://www.w3.org/TR/xml-stylesheet/")
uses processing instructions, the canonical form of such a document will not
include the stylesheet
linking information.  I would recommend that the canonicalization process
preserve the style-sheet linking
processing instruction(s).

Comments anyone, especially those of you with a legal background?

Regards, Ed

Received on Wednesday, 11 August 1999 15:21:59 UTC