[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Rich & Elliotte were right, I was wrong

• To: Rich Salz <rsalz@d...>
• Subject: Re: Rich & Elliotte were right, I was wrong
• From: Dennis Sosnoski <dms@s...>
• Date: Mon, 15 Mar 2004 13:08:09 -0800
• Cc: xml-dev@l...
• In-reply-to: <405618A6.5030501@d...>
• References: <ADA1E0AB9452BB48B063228627805EC901726EB1@R...> <4056139E.2070704@s...> <405618A6.5030501@d...>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312

Rich Salz wrote:

>Dennis Sosnoski wrote:
>  
>
>>This suggests to me that XML DSig is basically a questionable idea. Why 
>>the obsession with text? It seems like doing this at the Infoset level 
>>would be much simpler (and much more efficient).
>>    
>>
>
>(XML DSIG and XML-Encryption are based on the XPath 1.0 model.)
>
>Cryptography works on bytes.  Since there is no standard serialization 
>for an Infoset, and since you can create infosets that are 
>unserializable, you cannot build cryptographic functions such as 
>signature and encryption without first solving those problems.
>
Well, on the bright side I guess the extreme overhead of basing DSIG and 
Encryption on XPath rather than some standardized serialization of the 
Infoset means there's a growing market for appliances to take over the 
processing... but I guess you already know that. :-)

>Or, you can say that the fact that security relies on bytes means that 
>the whole infoset approach will fail because security is more important 
>than an abstract information model. :)
>
>  
>
I'd suspect that any reasonable implementation of c14n is actually 
working at a level equivalent to the Infoset internally, anyway - it 
just serializes the Infoset out following the special rules for c14n 
XML. Is there any other way of handling c14n that's not equivalent to this?

  - Dennis

• Follow-Ups:
  • Re: Rich & Elliotte were right, I was wrong
    • From: Rich Salz <rsalz@d...>

• References:
  • RE: Rich & Elliotte were right, I was wrong
    • From: "Derek Denny-Brown" <derekdb@m...>
  • Re: Rich & Elliotte were right, I was wrong
    • From: Dennis Sosnoski <dms@s...>
  • Re: Rich & Elliotte were right, I was wrong
    • From: Rich Salz <rsalz@d...>

• Prev by Date: Type unique can not occur after declaration
• Next by Date: Re: Rich & Elliotte were right, I was wrong
• Previous by thread: Re: Rich & Elliotte were right, I was wrong
• Next by thread: Re: Rich & Elliotte were right, I was wrong
• Index(es):
  • Date
  • Thread