Re: [XML Signature] DSig-01

[Rich Salz <rsalz@zolera.com>]

Anders Rundgren wrote:
> 
> Scott,
> In OBI V4 we will use SOAP's way of signing for SOAP-enveloped
> messages.

What is SOAP's way of signign?  Is it the W3C Note on SOAP Security?  If
so, I think there's a good chance it will end up being only marginally
useful -- it provides a way to carry a signature when the application
itself doesn't provide one. Who is going to use that?  Either the
application cares about the signature, in which case it should "leave
space" in its XML schemata, or it doesn't care and the SOAP system will
be doing signature validation, in which case it's probably good enough
to use SSL/TLS.
	/r$
-- 
Zolera Systems, Your Key to Online Integrity
Securing Web services: XML, SOAP, Dig-sig, Encryption
http://www.zolera.com