- From: Joseph M. Reagle Jr. <reagle@w3.org>
- Date: Wed, 25 Jul 2001 15:56:27 -0400
- To: "XML Encryption WG " <xml-encryption@w3.org>
- Cc: "IETF/W3C XML-DSig WG" <w3c-ietf-xmldsig@w3.org>
Completing an action item from last week's xmlenc f2f:
http://www.w3.org/Encryption/2001/Minutes/0720-Redwood/minutes.html#forwarding
>After further discussion, the group agrees to include a
>statement akin to, "the presence of encryption does not imply
>anything about integrity or authenticity of the message" and
>include a reference to those sections ("see what you sign") of
>xmldsig; add a sentence in XML-dsig with this recipient issue as an
>example. Action Reagle: do the edits to xmlenc and
>xmldsig specs.
Encryption now reads:
http://www.w3.org/Encryption/2001/Drafts/xmlenc-core/Overview.html#sec-Security
>6.1 Relationship to XML Digital Signatures
...
>Also, recipients of encrypted messages must remember that
>encryption itself does not imply anything about the integrity or
>authenticity of that data [XMLDSIG, 8.1.1 Only
>What is Signed is Secure].
DSig now reads:
http://www.w3.org/Signature/Drafts/xmldsig-core/Overview.html#sec-Secure
Second, information that is not signed but part of an
envelope containing signed information is obviously not secured.
For instance, unsigned recipient headers accompanying signed
information within an encrypted envelope does not have its authenticity or
integrity protected.
--
Joseph Reagle Jr. http://www.w3.org/People/Reagle/
W3C Policy Analyst mailto:reagle@w3.org
IETF/W3C XML-Signature Co-Chair http://www.w3.org/Signature
W3C XML Encryption Chair http://www.w3.org/Encryption/2001/
Received on Wednesday, 25 July 2001 15:56:29 UTC