Re: [atoca] New Version Notification for draft-barnes-atoca-escape-01.txt

[Martin Thomson <[e-mail]>]

On 11 September 2012 12:36, Art Botterell <[e-mail]> wrote:
> Hi Martin -
>
> Not sure how one might implement digital signatures of XML without canonicalization, really, but if that "accepted wisdom" is correct, wouldn't that better be addressed by refinement or replacement of RFC3275 rather than vectoring off into development of a "splinter" specification?

That's precisely the problem.  I can digitally sign a serialization of
XML relatively trivially, but to truly sign the XML then you need to
canonicalize the content.  JOSE are dealing with signing in a
completely different fashion for this exact reason: they only deal
with the serialization.  That simplifies implementation greatly.

> I do observe that all the various implementers of IPAWS-compatible systems in the US have had to implement XML signatures and seem to have managed without undue difficulty.  Perhaps the available libraries have improved.

Perhaps they have.  Though I note that it's a different matter to
implement this sort of canonicalization in millions of devices with a
wide range of capabilities.  Last I checked, XML canonicalization
libraries weren't small either.

> And I'm not clear on what it is that tokens would optimize, but hopefully Richard can explain that.

Checking a signature is expensive.  Proving that you have access to
the pre-image for a prearranged hash allows clients to filter out
bogus alerts quickly.