Re: [Curdle] should we include xmldsig and xmlenc?

[Simon Josefsson <[e-mail]>]

XML Digital Signatures is mentioned in the curdle charter text.  I
suggest to add XML Encryption too.

Incidentally, I approached Wendy and Frederick Hirsch about this last
month, and their recommendation (IIUC) was that since the W3C group is
in maintenance mode it would be preferrable to announce work on this to
their list and then go from there.

I have an Ed25519/Ed448-for-XMLDigSig document sitting on my disk, but
it is pending feedback from implementers.  I don't believe it would be
useful to approach this as a prescriptive work.  I can post the document
as an I-D if that would help get implementations going, but I don't
think we should adopt this if nobody is interested in implementing it.
I'm hesitant about burning energy on corner-cases since it will delay
publishing the documents that implementers deployed years ago.

Another option may be for the IETF to recognize reality and recommend
against further use of XMLDigSig/XMLEnc completely.  I.e., "XML Security
Considered Harmful".  A compromise would be to say that it is OK to use
for existing use-cases, but don't use it in new protocols.  I believe
that reflect the general thinking among implementers about XML Security
in general.

/Simon

Stephen Farrell <[e-mail]> writes:

> Hiya,
>
> I was at a thing with some w3c folks yesterday and mentioned
> curdle. It is conceivable that W3C may want to add codepoints
> to xmldsig and xmlenc for the new curves, just like we do. So
> far though, I've not seen anyone ask specifically for that.
>
> xmldsig was a joint bit of work between the IETF and W3C but
> that was a bit of a process-pain, so xmlenc was just done as
> a W3C thing. OTOH, Don Eastlake did write up an RFC for some
> additional algorithms for those as RFC6931 as well. [1] I
> guess that amicable divorce wasn't ever fully finalised:-)
>
> So, questions:
>
> 1. is there interest to define how to use the new curves for
>    xmldsig and xmlenc?
> 2. if 1==yes, do we have volunteers to do the editing work?
> 3. if 1==yes and 2==yes, is curdle the right place to do that
>    or should we just leave that to W3C to handle as and when
>    they want?
>
> FWIW, I've no strong opinions on this, but if this group
> felt that the answers to all 3 questions are yes, then we
> should probably sort that out with W3C (one way or another)
> while we're chartering curdle. If any of the answers is no,
> then we're good as-is and there's nothing else we need do
> for now.
>
> Cheers,
> S.
>
> PS: mnot and Wendy are cc'd as they're the relevant liaison
> folks between the IETF and W3C.
>
> [1] https://tools.ietf.org/html/rfc6931
>
> _______________________________________________
> Curdle mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/curdle