RE: Why isn't KeyInfo inside SignedInfo [Attn: Brian L.]

There has been some discussion on this in the past, see
the threads starting at 
"http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2000JanMar/0174.html"
and 
"http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2000JanMar/0193.html"
for example.
 
I think though it would be timely if Brian summarized the answer
to the question again.  There has been a lot of traffic on the XML
Encryption
list wondering why KeyInfo isn't signed.  
 
Brian, could you cross-post your answer to XML Encryption please.  If anyone
else would like to respond who's delved into the issue, that would be fine
too.
 
Ed
----------------------------------------------------------------------------
---------- 
Ed Simon 
Software Engineer, Entrust Technologies 
email:  ed.simon@entrust.com 
ph: (613) 247-2583 
----------------------------------------------------------------------------
---------- 
 

-----Original Message-----
From: John Boyer [mailto:jboyer@PureEdge.com]
Sent: Monday, August 28, 2000 8:04 PM
To: XML DSig
Subject: Why isn't KeyInfo inside SignedInfo


This might be a no-brainer at this point, but I just noticed that KeyInfo is
not inside SignedInfo.
 
Why is this?
 
It seems that during signature generation, all data within KeyInfo can be
filled in prior to generating the SignatureValue.  The signer chooses his
identity before the SignatureValue is created.
 
Otherwise, the material in KeyInfo would seem to be largely untrustworthy
even if our signatures validate.  After validation, we would have to dig up
the real information from the actual certificates just to be sure that all
of this identity information wasn't substituted on us by an attacker.  
 
On the other hand, perhaps it is done this way to force application
developers to obtain the information (like subject name) from the
certificate to avoid attacks from those who would generate a faulty
signature.
 
In which case, why bother breaking this information out into XML?
 
Thanks,
 	
	 John Boyer
Development Team Leader,
Distributed Processing and XML 
PureEdge Solutions Inc. 
Creating Binding E-Commerce
v: 250-479-8334, ext. 143  f: 250-479-3772
1-888-517-2675    <http://www.pureedge.com/> http://www.PureEdge.com