- From: <rhimes@nmcourt.fed.us>
- Date: Mon, 22 Nov 1999 15:11:12 -0700
- To: <w3c-ietf-xmldsig@w3.org>
John Boyer wrote: >The only thing we can safely count on being available is the document we >are currently working with. To create a tight, complete core behavior, we >should only be signing stuff in that document and pushing the resource >location issues to the application. >This proposal is by no means perfected, and it is heavily reliant on a >subset of what we already have. Really all I'm proposing is getting rid >of the unnecessary baggage that has been added by the fact that we want to >sign external resources with core behavior when clearly we cannot. It isn't clear to me that we shouldn't be able to sign external bytes referenced by a URL in core behavior. It doesn't make sense to me to have to encode and include a BLOB in order to sign it. Perhaps locations should be restricted to certain protocols in their simplest forms (http, ftp, file, etc.) We should be able to use standard URLs if they can be reasonably dereferenced. Maybe I'm missing something here. Thanks, Rich
Received on Monday, 22 November 1999 17:12:57 UTC