- From: Joseph M. Reagle Jr. <reagle@w3.org>
- Date: Thu, 07 Jun 2001 13:14:46 -0400
- To: Saroop Mathur <saroop@saroop.com>
- Cc: "Dournaee, Blake" <bdournaee@rsasecurity.com>, w3c-ietf-xmldsig@w3.org
At 12:28 6/7/2001, Saroop Mathur wrote: >If your implementation supports using public keys without certificates, >then you have an insecure product. http://www.w3.org/Signature/Drafts/xmldsig-core/Overview.html 1.0 Introduction The XML Signature is a method of associating a key with referenced data (octets); it does not normatively specify how keys are associated with persons or institutions, nor the meaning of the data being referenced and signed. Consequently, while this specification is an important component of secure XML applications, it itself is not sufficient to address all application security/trust concerns, particularly with respect to using signed XML (or other data formats) as a basis of human-to-human communication and agreement. Such an application must specify additional key, algorithm, processing and rendering requirements. For further information, please see Security Considerations (section 8). 4.4 The KeyInfo Element KeyInfo is an optional element that enables the recipient(s) to obtain the key needed to validate the signature. KeyInfo may contain keys, names, certificates and other public key management information, such as in-band key distribution or key agreement data. This specification defines a few simple types but applications may extend those types or all-together replace them with their own key dentification and exchange semantics using the XML namespace facility. [XML-ns] However, questions of trust of such key information (e.g., its authenticity or strength) are out of scope of this specification and left to the application. -- Joseph Reagle Jr. http://www.w3.org/People/Reagle/ W3C Policy Analyst mailto:reagle@w3.org IETF/W3C XML-Signature Co-Chair http://www.w3.org/Signature W3C XML Encryption Chair http://www.w3.org/Encryption/2001/
Received on Thursday, 7 June 2001 13:15:13 UTC