Re: Requirements and Goals for the Design of an 'XML Encryption Standard'

Dear Hal,

>Requirements R4.1 and the one below R4.2 (misnumbered as R4.1.3) read,
>"XES MUST define an encryption mapping from plain-text XML-documents to
>encrypted ones," and "The result of decrypting an encrypted XML-document
>MUST be a well-formed XML-Document."
>
>I didn't see a statement that decrypting an encrypted document should
>give you back what you started with.
This is not possible as a recipient may possess only a part of the
required keys. Thus we can maximally specify how such a partially
decrypted document must be represented.

>
>Or is it only supposed to give you back something which is (in some
>sense) "equivalent" to what you started with?  This relates to my
>question in another message about canonicalization.
>
>It seems to me that we have the power to give back bit for bit what was
>encrypted, since that is how encryption algorithms work.  This would of
>course provide equivalence for the widest set of requirements.
If we can agree on the logical representation level this makes sense.
Technologically parsers do not give you all the physical information which
would be required for bitwise physical representation encryption.
E.g. the white space between attributes or their order is lost.
If an application requires a particular physical format, e.g. c14n, this
should be an optional transformation, but not a default as many other
applications may not require such a representation form.

By the way we think that simple serialization algorithms like reading the
plaintext bit for bit are harmfull in general.
E.g. if schema informations exist at encryption time that include default
attribute values, these default values are lost. Assuming further that
the original schema definition is not accessible at decryption time,
these values can't be restored.


Best regards,
Gerald Huck                       Arne Priewe

IPSI - OASYS                      Student of Computer Science at the
GMD Darmstadt                     University of Frankfurt
Germany                           Germany
E-mail: huck@darmstadt.gmd.de     E-mail: priewe@darmstadt.gmd.de

Received on Monday, 20 November 2000 16:01:54 UTC