Maneesh
Thank you for your comments. I've put editor notes in the next draft to reflect them.
Yes, adding a transform to indicate that all attachments must be included in a single <ds:Reference> hash sounds useful for addressing the attachment insertion/deletion threat without needing to secure the entire multipart message. (i.e. this would not include the primary SOAP part).
Content-Location would require more complicated resolution mechanisms and it may be simpler to only specify Content-Id. Is there a strong reason to allow both when a sender should be capable of using Content-Id?
regards, Frederick
Frederick Hirsch
Nokia
> -----Original Message-----
> From: ext Maneesh Sahu [mailto:]
> Sent: Thursday, June 03, 2004 2:42 PM
> To:
> Subject: FW: [wss] SOAP with Attachments Proposal
>
>
> Forgot to copy the list...I am forwarding the mail I sent to the SwA
> profile authors.
>
> --ms
>
> -----Original Message-----
> From: Maneesh Sahu
> Sent: Thursday, June 03, 2004 11:15 AM
> To: ''
> Cc: ''; ''
> Subject: RE: [wss] SOAP with Attachments Proposal
>
> Hi Frederick,
>
> The WSS SwA profile is very useful.
>
> I had some feedback about the document.
>
> Page 5- "Securing SOAP with Attachments" paragraph 2 says that
> "Attachments may be referenced using a CID scheme URL to refer to the
> attachment that has a Content-ID MIME header value that corresponds to
> the URL scheme,..."
>
> It will be useful to refer to the attachment using the
> Content-Location
> MIME header as well. Content-Locations can be referenced using both
> relative and absolute paths.
>
> I am also thinking about the impact of SwA on other profiles
> like SAML.
> There are certain scenarios in the WSS SAML profile like holder-of-key
> where the SOAP body needs to be signed for message integrity. If the
> request is SwA then the Body along with all the attachments must be
> signed.
>
> Should there be a dsig transform like sign all attachments?
> This way if
> an attachment was added to the request after the request was signed,
> message tampering can be detected.
>
>
> Regards
> Maneesh Sahu
> Westbridge Technology
>
>
> -----Original Message-----
> From: [mailto:]
> Sent: Friday, May 28, 2004 11:01 AM
> To:
> Cc: ; ;
>
> Subject: [wss] SOAP with Attachments Proposal
>
> Enclosed is a draft profile for securing SOAP with Attachments (SwA)
> using WSS SOAP Message Security.
>
> I am sending this to close the action item recorded on the
> 5/18/04 call
> to submit a proposal, related to issues 285, 268, and 129, taken by
> Mike McIntosh, Jerry Schwarz and myself.
>
> We intend this as a starting point for members of the WSS TC
> to discuss
> and improve.
>
> Thanks
>
> regards, Frederick
>
> Frederick Hirsch
> Nokia
>
> <<wss-swa-profile-1.0-draft-03.pdf>>
>
>
>
> To unsubscribe from this mailing list (and be removed from
> the roster of the OASIS TC), go to
> http://www.oasis-open.org/apps/org/workgroup/wss/members/leave
> _workgroup.php.
>
>
