RE: [dss] OASIS DSS "Request for Feedback" - Signing Templates

[John Messing <jmessing@law-on-line.com>]

I think this is very well stated and I agree.

> -------- Original Message --------
> Subject: RE: [dss] OASIS DSS "Request for Feedback" - Signing Templates
> From: "Rich Salz" <rsalz@datapower.com>
> Date: Mon, September 13, 2004 4:28 pm
> To: "Edward Shallow" <ed.shallow@rogers.com>
> Cc: kuehne@klup.de, "'OASIS DSS TC'" <dss@lists.oasis-open.org>
> 
> > The template
> > approach does not advocate dropping input editing and validation.
> 
> One possible concern is that the DSIG spec has a number of extension
> points (dsig:Object, for example), and a DSS server has to make sure that
> the client hasn't "slipped in" something past the server.  As another
> concern, consider a single keypair which has been certified multiple
> times.  WS-Security and WS-I basic security profile have just been dealing
> with this. A template approach might allow a client to identify the
> "wrong" signing certificate; for example, the low-liability cert even tho
> the server is (only?) authorized to use the high-value, corporate-level,
> cert.
> 
> These are not insoluble problems, but taken overall I think the approach
> is too risky to put into the core.  It could require a great deal of
> *semantic* understanding, as opposed to lexical/syntactic understanding,
> of every request.
> 
> 	/r$
> 
>  --
> Rich Salz                  Chief Security Architect
> DataPower Technology       http://www.datapower.com
> XS40 XML Security Gateway  http://www.datapower.com/products/xs40.html
> XML Security Overview      http://www.datapower.com/xmldev/xmlsecurity.html
> 
> 
> To unsubscribe from this mailing list (and be removed from the roster of the OASIS TC), go to http://www.oasis-open.org/apps/org/workgroup/dss/members/leave_workgroup.php.