Normalizing and signing XML -- Xoxa

[Norman Gray <norman@astro.gla.ac.uk>]

Greetings.

Normalising and signing XML is a well-known pain in the neck. You don't have to look far to find expressions of horror and dismay or even the outright rejection of the idea that XML is signable other than as a text string (Peter Gutmann: ‘XML is an inherently unstable and therefore unsignable data format.’ [1]).

XML DigSig is hard because XML Canonicalization is hard; and that's hard because, I think, it's happening at the wrong level (lexical rather than structural).

I believe it's possible to define an alternative canonicalization which accepts a larger range of input documents as equivalent, and which has fewer bells and whistles (and gongs and bugles), but which is much simpler both to define and to implement. I describe that in a preprint at arXiv [2], and it's illustratively implemented in both C and Java in a library called Xoxa[3]

I've expanded on this in a blog-post at <http://text.nxg.me.uk/2015/b65m>.

I'd be very interested in thoughts from the august denizens of xml-dev.

All the best,

Norman


[1] https://www.cs.auckland.ac.nz/~pgut001/pubs/xmlsec.txt
[2] http://arxiv.org/abs/1505.04437
[3] https://bitbucket.org/nxg/xoxa

-- 
Norman Gray  :  http://nxg.me.uk
SUPA School of Physics and Astronomy, University of Glasgow, UK