Re: [dss] REFORMULATED ISSUE#2: SIGNATURECONTENTS (SIGN REQUEST DISCUSSION)

[Trevor Perrin <trevp@trevp.net>]

At 02:08 PM 9/12/2003 +0200, Juan Carlos Cruellas wrote:


>COMMENT: For me this means that the text says that it may be the case that
>a requester
>sends an Input document, A. He has to send in fact two informations to the
>server:
>         1. Information on what elements of the input document A have to 
> be signed.
>         2. Information of the additional transformations that the server 
> has to
>apply to these elements.
>Now the server does the following:
>
>1. It builds up B (set of elements that will eventually be signed) from the
>information in 1. This information
>sent by the requester can be a XSLT transformation or a XPath expression.
>
>2. It builds up C by transforming B according the indications in additional
>transformations.
>
>3. It envelopes B!!! in the signature. At least this is what I understand
>from the text.

Hmm.  So you're saying there's the:
  - "selection transforms" A -> B, and the
  - "signature transforms" A -> C, B -> C

A = input documents
B = enveloped or enveloping documents
C = the final post-transformed data that's actually signed

You're right, that's what 3.5.1 in the requirements doc appears to say.
I'd say that's the most complex of 3 choices:

1) selection transforms can produce enveloped or enveloping docs
2) selection transforms can produce only enveloped docs
3) no selection transforms

Perhaps we can revisit the requirement.  I'm not sure it's important to be 
able to select particular parts of Input Documents.  Doing (3) would make 
things easier.

I'll try to get list feedback on this.


>So, you seem to say that the meaning of the text in the req. doc is the one
>you mentioned?

No, I think your reading is correct.  But I'm wondering if we can revisit 
this and cut out the words "particular parts" from 3.5.1.

Trevor