ebxml-msg — archive

[System]

> I have not yet managed to fully comprehend the XMLDSIG spec. There > isn't, by any chance, a way to use XMLDSIG solely for creating and > transmitting a message digest, without any digital signature? You can mostly get there; the document hash(es) are separate elements from the signature. So while it won't be an xmldsig doc, it gets 90% re-use. In order to do a real hash, you have to do XML canonicalization, which is a pain. And then you also have to consider how you canonicalize and hash the attachments. It ends up being an awful lot of work. Are there any other IETF-spec'd TCP-based services that do this? SSL/TLS -- so perhaps saying "use ssl if you're worried about tcp bitrot" is the way to go. /r$ -- Zolera Systems, Securing web services (XML, SOAP, Signatures, Encryption) http://www.zolera.com