RE: [fwd] [dix] fyi: SAMLv2: HTTP POST ?NoXMLdsig? Binding (from: Jeff.Hodges@neustar.biz)

I would suggest that it might be more appropriate to call it "no
Canonicalization" rather than "NoXMLdsig"; it is entirely possible,
sensible, and widely practised to use an XML Signature to sign a
base64-encoded string. The reason it is called XML Signature is because the
signatue is expressed in XML, not because the hashed data has to be
expressed as XML.

Why not keep the XML Signature and use it to sign the base64-encoded SAML in
the proposed protocol? Or use another pre-existing, non-XML-aware spec as
Anders has suggested?

Ed
_____________________________
Ed Simon <edsimon@xmlsec.com>
Principal, XMLsec Inc. 
(613) 726-9645 

Interested in XML, Web Services, or Security? Visit "http://www.xmlsec.com".


New! "Privacy Protection for E-Services" published by Idea Group (ISBN:
1-59140-914-4 for hard cover, 1-59140-915-2 for soft cover). 
Includes a chapter, by Ed Simon, on "Protecting Privacy Using XML, XACML,
and SAML".
See the Table of Contents here: "http://tinyurl.com/rukr4".

-----Original Message-----
From: w3c-ietf-xmldsig-request@w3.org
[mailto:w3c-ietf-xmldsig-request@w3.org] On Behalf Of Anders Rundgren
Sent: June 24, 2006 16:58
To: w3c-ietf-xmldsig@w3.org
Subject: Re: [fwd] [dix] fyi: SAMLv2: HTTP POST ?NoXMLdsig? Binding (from:
Jeff.Hodges@neustar.biz)


Interesting, although I don't understand this completely.

It seems that the signature only contains the actual signature value and no
KeyInfo etc.
If I had looked for a simpler (binary) solution, I would rather have used
CMS.
The primary (only) rationale for this proposal appears to be that
canonicalization takes too much CPU.
There is a risk that this may be based on non-optimal implementations rather
than a fact.

Anders Rundgren

----- Original Message -----
From: "Thomas Roessler" <tlr@w3.org>
To: <w3c-ietf-xmldsig@w3.org>
Sent: Saturday, June 24, 2006 07:39
Subject: [fwd] [dix] fyi: SAMLv2: HTTP POST ?NoXMLdsig? Binding (from:
Jeff.Hodges@neustar.biz)



FYI
-- 
Thomas Roessler, W3C   <tlr@w3.org>





----- Forwarded message from Jeff Hodges <Jeff.Hodges@neustar.biz> -----

From: Jeff Hodges <Jeff.Hodges@neustar.biz>
To: Digital Identity Exchange <dix@ietf.org>
Date: Fri, 23 Jun 2006 15:16:34 -0700
Subject: [dix] fyi: SAMLv2: HTTP POST
 ?NoXMLdsig? Binding
Reply-To: Digital Identity Exchange <dix@ietf.org>
List-Id: Digital Identity Exchange <dix.ietf.org>
X-Spam-Level: 

Given the various issues with XMLdsig and discussions with various folks, 
Scott Cantor and I crafted a new SAML HTTP POST binding which doesn't rely 
on XMLdsig, but specifies optional signing of the conveyed messages, as 
"blobs". We've tentatively named the binding "HTTP-POST-NoXMLdsig". The 
working draft spec is here..

SAMLv2: HTTP POST ?NoXMLdsig? Binding [DRAFT]
http://www.oasis-open.org/committees/download.php/18722/draft-hodges-saml-bi
nding-noxmldsig-01.pdf

The basic notion of this draft binding was well-received by the SSTC and the

consensus on a recent SSTC concall was that we'd proceed with putting it on 
the SSTC/OASIS equivalent of "the standards track". Note that this spec is a

*working draft* and some details will change, and comments are welcome.

This binding could be leveraged/profiled in the DIX context in order to 
provide the capability for implementors/deployers to optionally use 
conventional sign-the-BLOB techniques, or the SXIP/DIX Message 
Signature/Verification technique, or no signatures.


JeffH






_______________________________________________
dix mailing list
dix@ietf.org
https://www1.ietf.org/mailman/listinfo/dix



----- End forwarded message -----

Received on Sunday, 25 June 2006 19:56:42 UTC