[security-services] AI-18: review of XML DSIG issues

[Irving Reid <Irving.Reid@baltimore.com>]

I finally followed up on this one; here are Merlin's comments (slightly
edited) on the current SAML DSig draft:

Hi Irving,

I quickly scanned the SAML XMLDSIG guidelines (rev 3) and all
appears in order; some minor comments below:

Ref:
http://www.oasis-open.org/committees/security/docs/draft-sstc-xmlsig-guideli
nes-03.pdf

line 77-78: c14n only transforms an XML node set, not an octet stream
  - the xmldsig transform will parse an octet stream into a node set for
  subsequent c14n

lines 81-84: the text seems to switch between inclusive and exclusive a
couple of times in this paragraph - we mean exclusive, don't we?

line 133: editorial - also ... as well (one or the other, but not both)

line 148: #1234 is an invalid id ref (start with a letter, _ or :)
  http://www.w3.org/TR/REC-xml#id

line 155: samlp:Response, not ::

line 168: applied "first" implies before the enveloped-signature transform,
  but the sample XPath filter incorporates the env-sig xform

lines 171-175: strange [InclC14N] text

merlin

 - irving - 


-----------------------------------------------------------------------------------------------------------------
The information contained in this message is confidential and is intended
for the addressee(s) only.  If you have received this message in error or
there are any problems please notify the originator immediately.  The 
unauthorised use, disclosure, copying or alteration of this message is 
strictly forbidden. Baltimore Technologies plc will not be liable for
direct, special, indirect or consequential damages arising from alteration of the
contents of this message by a third party or as a result of any virus being 
passed on.
 
This footnote confirms that this email message has been swept for Content Security threats, including
computer viruses.

http://www.baltimore.com

 
This footnote confirms that this email message has been swept by 
Baltimore MIMEsweeper for Content Security threats, including
computer viruses.