XML DSig Canonicalization Oddities

Dear List,
After starting to work with XML messages embedding XML signatures
I of course ran into validation problems due to namespace inheritance.
After some "googling" I found the cure and of course it was you guys who
had  made it as well :-)  A bit late in the process, but anyway. :-|
I mean this one: http://www.w3.org/2001/10/xml-exc-c14n# .

Still I'm not 100% sure how this scheme works.  Am I correct
if I say that the existance of the URI above in "CanonicalizationMethod"
limits the outermost scope of name-spaces to the "Signature" element?

Does this also mean that the following is a bad design that will fail
to validate in most implementations:

<my:elem my:xmlns="htpp....">
  <dsig:Signature dsig:xmxns=...>
   <dsig:SignedInfo>
    <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n# ">
      .
      .
  <Object>
     <my:something_defined_in_the_ns_outside_of_Signature.....>
  </Object>
</Signature>
</my:elem>

That is, should you redeclare the the ns associated with "my" _inside: of the
Signature declaration to be compatible with conforming systems?

MC & HNY!

Anders Rundgren

Received on Monday, 22 December 2003 14:08:36 UTC