RE: [xri] Comment on call re: algorithm agility

["Scott Cantor" <cantor.2@osu.edu>]

Drummond Reed wrote on 2009-06-12:
> So Scott, from a spec standpoint, what does this mean we should/should not
> do in the XRD 1.0 spec?

I was making two points, one purely pragmatic.

Whatever/however signing is done, SHA-256 should probably be the recommended
or MTI digest algorithm for hashing and as part of the RSA operation. (With
XML Signatures, you have to pay attention to both the digest alone for the
Reference and then as part of the signature over SignedInfo.)

The other argument was that reinventing signatures in each standard leads to
greater effort in achieving agility across the full stack of code you're
deploying.
 
-- Scott