- From: Joseph Reagle <reagle@w3.org>
- Date: Fri, 11 Jan 2002 15:45:15 -0500
- To: "Takeshi Imamura" <IMAMU@jp.ibm.com>
- Cc: "Hiroshi Maruyama" <MARUYAMA@jp.ibm.com>, xenc <xml-encryption@w3.org>
On Monday 07 January 2002 06:43, Takeshi Imamura wrote: > >Is this because you do not think the scenario is a compelling one, or it > >isn't merely specified that way yet? Would you be opposed to > > generalizing this to work for EncryptedKey or EncryptedData? (If we > > don't support this, what does it mean when someone adds an EncryptedKey > > to an XML instance that > >has already been signed?) > > Sorry, I don't follow this. Do you expect the added EncryptedKey element > is being decrypted if the element is not referenced from an Except > element? If so, what happen when the element is decrypted? Sorry, I don't think I was being clear. We have this transform so that we can validate a signature over a document that has EncryptedData's inserted both before *and* after a signature. The transform tells us to decrypt the EncryptedData's except for those that are specified in the Except -- because they were signed in their encrypted form. My question is, can we imagine any scenarios where a document might have EncryptedKeys added in a document both before *and* after a signature. Would we want the capability to decrypt some but not others for Signature Validation. I can imagine two answers this question: 1. There are no such scenarios. 2. Since EncryptedKey's are used for "internal" processing only, (they're a "ends to a means"; they're not likely to be replacing any native data in the original source document), they can stay in their Encrypted form regardless. What do you think? -- Joseph Reagle Jr. http://www.w3.org/People/Reagle/ W3C Policy Analyst mailto:reagle@w3.org IETF/W3C XML-Signature Co-Chair http://www.w3.org/Signature/ W3C XML Encryption Chair http://www.w3.org/Encryption/2001/
Received on Friday, 11 January 2002 15:45:35 UTC