[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Canonicalizer that uses XML Schemas (rather than DTDs)?

datapower linux
> Is it not time to update the XML canonicalization specification?

Why do you need canonicalization?  The most common use is for security, 
where c14n is necessary for digital signatures.  If you are signing 
something, then you must sign both the XML document, and the associated 
schema.  If you don't sign the schema, then the recipient (or an 
adversary) can change the schema and your signature will be "broken." 
For example, if a conference requires a digitally signed submission 
(because it includes, say, intellectual property issues), and they 
validate submissions against a DTD, or RNG, or whatever, then your 
signed submission better cover the schema or your academic competitor 
could get your submission invalidated.

DTD's are different from other XML Schema languages in that they can be 
embedded in the XML document.  Therefore, stripping out the DTD and 
expanding it in-line is sensible and efficient.  (It also doesn't 
require us to define DTD c14n.)  And, of course, SOAP outlaws DTD's.

In other words, for security reasons, DTD's are treated special because 
they are special, and in cases where they aren't, it's a matter for the 
DSIG spec, not the c14n specs.

Make sense?


Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html


Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
First Name
Last Name
Subscribe in XML format
RSS 2.0
Atom 0.3

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.

Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.