Re: [dss] Requesr for comments: Proposal of message for XMLDSIG

[Trevor Perrin <trevp@trevp.net>]

At 07:27 PM 4/7/2003 +0200, Juan Carlos Cruellas wrote:
 >
 > Within the OASIS Digital Signature Services Technical Committee, that is 
currently working
 > in the specification of Web Services for producing and veriffying 
digital signatures, the issue
 > of dealing with the requirement of What You See is What You Sign has 
been raised by some
 > members. It deals with the signature of the result of applying 
transformation(s) to the original
 > XML data to convert it in a more human readable form (let us say HTML) 
as there seem to be
 > situations where this readability requirement is present. This issue is 
in consequence related
 > NOT with c1n4 canonicalization but with additional transformations that, 
as I mentioned
 > before, transforms the original XML data in a different document perhaps 
in a different format...
 > The aforementioned TC  would like to know if the XMLDSIG group has 
identified this as an
 > issue and in such case if you have
 > came up to any conclusions about how it could be managed. If not, the TC 
would
 > like to get your advice in order to address a suitable forum where to 
address.

I would mention more explicitly that we're trying to figure out how to sign 
*both* the XML document and its human-readable transformed version, in a 
single signature, and maybe present some of the solutions we've considered 
(see my other mail) and some of the issues (such as XSLT transform engines 
producing different output).

Trevor