URI security problems

[Anders Rundgren <anders.rundgren@telia.com>]

Nigel,
I have som problems understanding this URI vulnerability issue, but then I am
not a cryptologist either :-).

The URIs references in S2ML documents not are to be used for http (or whatever) access,
they are just UNIQUE identifiers.  But if we anyway assume that they are indeed used for access and
DNS is hacked or the web-server cracked so you end up with a faulty name assertion object.

Now my question is: Will this faulty object
- Have an ID that matches the DependsOn in the Entitlement?
- Be signed by an authority the verifier trusts?

If this faulty object does not obey both these qualities it should not pass the verifier.
Note the requirements of unique identifiers which is a MUST to make this work.
Exactly like serial numbers for X509 certificates.

It is true that hashing the entire name assertion would make binding even stronger
but it looks like overkill to me.  Why bother to sign the name assertion in the first
place if you can't trust such a in basic cryptographic operation?

That the MIME-bindings referred to by John Linn are different than for https, is because
the SMTP transport is insecure, not due to URI references between S2ML objects.

Anders