Re: [dss] REFORMULATED ISSUE#2: SIGNATURECONTENTS (SIGN REQUEST DISCUSSION)

[Trevor Perrin <trevp@trevp.net>]

At 06:36 PM 9/16/2003 +0200, Juan Carlos Cruellas wrote:
><JC>
>Well, it seems that we are going towards a service that signs and does
>other things
>(compound operations, etc).
>I do not remember now what were the reasons why the text dealing with the
>possibility
>of getting parts of the documents was added to the req. doc,

I don't recall either, possibly just over-ambitious wording.

>  but I guess
>that they should
>be found in the use cases submmitted....Perhaps before making a decision of
>going ahead
>with what is easiest we should try to identify the use case from which this
>requirement was
>derived, and think of the usefulness of this feature.

I'm not sure it comes from any specific use case.  So we'll have to decide 
its usefulness on our own.  I don't have enough experience with DSIG to 
know if this is useful or not.

Can anyone else speak to the common uses for enveloping signatures?  I'm 
only familiar with enveloping signatures which contain Signature 
Properties.  Are there other uses for enveloping signatures which contain 
elements selected from a larger document?

If no-one has a good example, I'm inclined to leave it out.

>
>Another consideration: even if we contemplate this possibility, we would
>not force anybody
>to use it!

I dunno.  Once you put a feature in,
  - everyone who reads the spec has to contemplate it,
  - server implementors have to support it on the off-chance some client 
tries it,
  - toolkit implementors have to support it on the off-chance some end-user 
wants it.

So even if it isn't used in a particular request/response, it still adds 
complexity up and down the line.

Trevor