OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]
Normalizing and signing XML -- Xoxa


Normalising and signing XML is a well-known pain in the neck. You don't have to look far to find expressions of horror and dismay or even the outright rejection of the idea that XML is signable other than as a text string (Peter Gutmann: ‘XML is an inherently unstable and therefore unsignable data format.’ [1]).

XML DigSig is hard because XML Canonicalization is hard; and that's hard because, I think, it's happening at the wrong level (lexical rather than structural).

I believe it's possible to define an alternative canonicalization which accepts a larger range of input documents as equivalent, and which has fewer bells and whistles (and gongs and bugles), but which is much simpler both to define and to implement. I describe that in a preprint at arXiv [2], and it's illustratively implemented in both C and Java in a library called Xoxa[3]

I've expanded on this in a blog-post at <http://text.nxg.me.uk/2015/b65m>.

I'd be very interested in thoughts from the august denizens of xml-dev.

All the best,


[1] https://www.cs.auckland.ac.nz/~pgut001/pubs/xmlsec.txt
[2] http://arxiv.org/abs/1505.04437
[3] https://bitbucket.org/nxg/xoxa

Norman Gray  :  http://nxg.me.uk
SUPA School of Physics and Astronomy, University of Glasgow, UK

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]

News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 1993-2007 XML.org. This site is hosted by OASIS