[OASIS Issue Tracker] Updated: (SECURITY-14) PE: Disallow Object element in signatures

[ http://tools.oasis-open.org/issues/browse/SECURITY-14?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SECURITY-14:
---------------------------------


Added to wd54 as E91.

> PE: Disallow Object element in signatures
> -----------------------------------------
>
>                 Key: SECURITY-14
>                 URL: http://tools.oasis-open.org/issues/browse/SECURITY-14
>             Project: OASIS Security Services (SAML) TC
>          Issue Type: Improvement
>          Components: Core
>    Affects Versions: Version 2.0
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 2.0 incorporating Approved Errata
>
>
> The XML Signature profile in SAML Core doesn't explicitly disallow the use of the <ds:Object> element in signatures, although it's discouraged by implication given the other restrictions imposed. Since the element is often used to carry out wrapping attacks, and its use was never profiled, we should discourage it explicitly.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://tools.oasis-open.org/issues/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira