RE: DSAKeyValue text

At 12:28 6/7/2001, Saroop Mathur wrote:
>If your implementation supports using public keys without certificates,
>then you have an insecure product.

http://www.w3.org/Signature/Drafts/xmldsig-core/Overview.html

1.0 Introduction
The XML Signature is a method of associating a key with referenced data 
(octets); it does not normatively specify how keys are associated with 
persons or institutions, nor the meaning of the data being referenced and 
signed. Consequently, while this specification is an important component of 
secure XML applications, it itself is not sufficient to address all 
application security/trust concerns, particularly with respect to using 
signed XML (or other data formats) as a basis of human-to-human 
communication and agreement. Such an application must specify additional 
key, algorithm, processing and rendering requirements. For further 
information, please see Security Considerations (section 8).

4.4 The KeyInfo Element
KeyInfo is an optional element that enables the recipient(s) to obtain the 
key needed to validate the signature.  KeyInfo may contain keys, names, 
certificates and other public key management information, such as in-band 
key distribution or key agreement data. This specification defines a few 
simple types but applications may extend those types or all-together replace 
them with their own key  dentification and exchange semantics using the XML 
namespace facility. [XML-ns] However, questions of trust of such key 
information (e.g., its authenticity or  strength) are out of scope of this 
specification and left to the application.


--
Joseph Reagle Jr.                 http://www.w3.org/People/Reagle/
W3C Policy Analyst                mailto:reagle@w3.org
IETF/W3C XML-Signature Co-Chair   http://www.w3.org/Signature
W3C XML Encryption Chair          http://www.w3.org/Encryption/2001/

Received on Thursday, 7 June 2001 13:15:13 UTC