Re: Again, confusing 8.1

Ed, Stephen,

See my previous message.

On Fri, Dec 17, 2004 at 11:39:10AM -0500, Ed Simon wrote:

> It seems to me that requiring an XML processor (right?) is going to be
> particularly performance-consuming.  Plus one has to deal with exactly
> what
> "All shared string values are encoded as XML" means.  To me, it means
> that
> the pass phrase MUST be valid XML (eg.
>
> "<Pass_Phrase xmlns="http://example.com/secrets">my
> <Adjective>little</Adjective>
> <![CDATA[&lt;]]>secret<![CDATA[&gt;]]>!</Pass_Phrase>"

From what I understand, the pass-phrase is never sent on the
clear. We're only sending the base-64 of a MAC computation.
So that should be valid XML.

However, one interesting point from Ed:
> 
> ) or else it is NOT a valid pass phrase, AND, therefore, pass phrase tools
> must be full-fledged XML parsers capable of dealing with potential attacks
> like entity expansion.  There is also a contradiction that if one requires
> conversion to lower-case, one invalidates XML such as that in my example
> because XML names are case-sensitive.  It seems to me the constraints are
> contradictory.
> 
> I think what was originally intended was something like "encode as UTF-8"; I
> expect requiring this would NOT break the interop cases done thus far
> because I would guess no one is trying to use pass phrases that are, in
> themselves, valid XML.

This makes me think that a user could go to any computer or device and
be able to regenerate the MAC in the same way... as if we need to
canonicalize the pass-phrase so that it's always possible to
regenerate the same MAC as needed.

For example, we could say:

Canonicalize the pass-phrase as follows:

- convert the pass phrase to UTF-8
- convert any remaining XML entity into UTF-8 characters

And then:

- apply the MAC algorithm

-jose