RE: Comments on XML-Signature Core Syntax

Your statement assumes that XML signatures need "the equivalent of PKCS-7 or
CMS authenticated attributes".  They don't.  XML makes things like CMS
signed attributes (and unsigned attributes) completely unnecessary and
obsolete; when you can exactly express the semantic content you wish to
secure as a single XML blob, there's no need to complicate the signature
structure with further adornments.  

In your example below, as you point out the notary does not "sign" the base
document.  Rather, the notary signs a new document which includes four
elements: (1) a "base" document, (2) customer's signature object on base
document, (3) a time-related object (perhaps something like a Surety
timestamp object), and (4) other semantic statements made by the notary.
Together, this compound object, which has its own type and semantics, is
then signed by the notary.  The semantic meaning of the notary-signed object
is clear from its type and contents, and the signed statement stands on its
own, independent of the customer's signature object (2) referenced inside.

If I rephrase your question as, "Assuming that I want to use something like
CMS signed attributes in my XML-DSIG application, is there agreement that
the attributes I define and create go into a SignatureProperties object?", I
believe the answer to this question is "No. It is certainly possible to do
it that way, if you so choose, but it's not required."

					--bal

-----Original Message-----
From: tgindin@us.ibm.com [mailto:tgindin@us.ibm.com]
Sent: Friday, October 29, 1999 2:19 PM
To: XML-DSIG
Subject: RE: Comments on XML-Signature Core Syntax


     Is there agreement that  the equivalent of PKCS-7 or CMS authenticated
attributes go into SignatureProperties?  I do think that the equivalents of
CMS authenticated attributes are very valuable in signing applications.  In
particular, in something like a notary service, the most natural form for
an "attestation" by a witness is a CMS authenticated attribute.  An example
of what I mean would be something like the following:
A)   An American notary (no extra legal powers) checks the photographic ID
of the customer who wants a signature notarized.
B)   Today, the notary adds the details of the ID to a large bound book
which is kept under lock and key.
C)   In CMS or PKCS-7, the natural thing to do would be to add an
authenticated attribute for "checked driver's license" or "checked
passport" to the base of the notary's signature, with a value containing,
among other things, "common name", "issuing jurisdiction", "serial number",
and "validity period".  Losing this capability in XML signing would not,
IMHO, be a good thing.

     The notary's signature would be applied to the base document, to the
customer's signature, to the signing time, and to the attestations
together.

          Tom Gindin

Received on Saturday, 30 October 1999 17:36:29 UTC