Ill-desiged transform sequences
"Gregor Karlinger" <[email protected]>
| Newsgroups | gmane.ietf.xmldsig |
|---|---|
| Message-ID | <[email protected]> |
Recently I had a discussion with a customer regarding the legality of an XML signature bearing a reference that has the following structure (which does not make sense at all, but should demonstrate the problem): 1. The URI attribute contains the empty string ""; 2. The first transform is a C14N transform; 3. The second transform is an enveloped sig. tf. I argued that such a signature is not legal regarding the processing model of XMLDSIG, since it is impossible to cut out the signature from a node set which, due to the intermediate C14N transform, does not represent the original XML document bearing the XML signature. A similar problem occurs, if the env. sig. tf. is re- placed by an XPath transform using the here() function. Any opinions? Regards, Gregor
smime.p7s
(application/x-pkcs7-signature, 9.3 KB) - not displayed