- From: Vamsi Motukuru <vamsi@phaos.com>
- Date: Thu, 11 Oct 2001 19:04:43 -0400
- To: <w3c-ietf-xmldsig@w3.org>
- Message-ID: <001a01c152a9$1d64f1f0$38844ec6@starlan.com>
Dear All, I've seen a fair amount of Q&A on this topic in the DSIG mailing list over the past several months, and the universally stated reason for canonicalizing SignedInfo before Reference validation is to enforce WYSIWYS. However, I'm still having trouble understanding how this would really be implemented for same-document fragment Reference URIs where the referenced XML is a sibling subtree of the enclosing document. For example: <MyDoc> <ItemList ID="TheList"> <Item num="001">First item</Item> <Item num="002">Second item</Item> </ItemList> <Signature> <SignedInfo> <CanonicalizationMethod> ... </CanonicalizationMethod> <SignatureMethod> ... </SignatureMethod> <Reference URI="#TheList"> <DigestMethod> ... </DigestMethod> <DigestValue> ... </DigestValue> </Reference> </SignedInfo> <SignatureValue> ... </SignatureValue> </Signature> </MyDoc> When, at the start of reference validation, XML-C14N (or some other canonicalization) is applied to the SignedInfo, the result is an octet stream. In order to proceed with retrieving the referenced object and calculating the digest value, the application will first need to parse the octet stream to recover an XML document with Reference elements in it. This results in a new document that does not contain the data object identified in the Reference URI. What now? Thanks, Ari Kermaier Phaos Technology Corp.
Received on Thursday, 11 October 2001 19:03:50 UTC