RE: [ebxml-msg] ds:Signature Algorithm

["Damodaran, Suresh" <Suresh_Damodaran@stercomm.com>]

David,

What was the rationale behind excluding ALL signature elements?

I thought there were two distinct use cases that applied to
the cases:
	a) to sign over existing signatures
		- e.g., useful when you want to prove party P1 (who has the
first
		signature) did sign a document in the event P1 denies it
later (right!) 
		
	b) to exclude existing signatures because verifying data integrity
of the document
		is the primary purpose and proving somebody actually did
sign the document
		is not necessary.
This is a business decision, and excluding one or the other use case doesn't
make sense to me.

Cheers,
-Suresh

		

-----Original Message-----
From: David Fischer [mailto:david@drummondgroup.com]
Sent: Tuesday, October 23, 2001 5:04 PM
To: Christopher Ferris (E-mail)
Cc: ebXML Msg
Subject: [ebxml-msg] ds:Signature Algorithm


Chris,

Since we are deciding to exclude ALL signature elements, shouldn't we get
rid of
the
http://www.w3.org/2000/09/xmldsig#enveloped-signature algorithm and just
use:

   <XPath> not(ancestor-or-self::ds:Signature) </XPath>

which would exclude ALL ds:Signature elements?  Or better yet:

   <XPath> not(ancestor-or-self::ds:Signature |

ancestor-or-self::*[@soap:actor="http://oasis-open.org/committees/ebxml-msg/
next
MSH"] |
	
ancestor-or-self::*[@soap:actor="http://schemas.xmlsoap.org/soap/actor/next"
] )
</XPath>

Regards,

David Fischer
Drummond Group.


----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>