RE: [security-services] RE: Comments on XML signature guidelines draft

[Scott Cantor <cantor.2@osu.edu>]

> is the addition of an "ID" attribute to SAML 1.1 worth considering?

I think it's practically a given at this point. I should have pushed
harder when Eve raised it, but I didn't realize the full extent of the
problems.

> From my limited understanding of the situation, it appears that some 
> kind of standard "hook" is needed to point to pieces of XML. As XPath 
> is a tree pattern-matching language, unsurprisingly it often exhibits 
> exponential behavior. The "ID" approach is not great but 
> gives the required functionality.

It's possible to do things efficiently with XPath without using ID, but
there doesn't appear to be any MUST piece of XML Signature that will do
what's needed except for xpointer(id()).

-- Scott