Re: [ltans] Canonicalization

[Markus Isler <[e-mail]>]

Hi Tobias

Yes  3.2. item 2. Sorry for the confusion and thanks for clarification.

I understand that it makes sense to canonicalize XML data if you integrate XMLERS into to XML structure you archived. This is similar to XMLDSIG. However XMLDSIG allows XML input only where XMLERS allows any input format like RFC 4998. Processing XMLDSIG input data is very clear. If it cannot be XML parsed it is invalid. Processing RFC 4998 input data is also clear as the input is a binary blob and I don't care about its format.  XMLERS is tricky because if I strictly follow the RFC 6283 a "canonicalization method MUST be used also for archive data when data is represented in XML format". As you mentioned before I can technically treat every input as binary blob unaware of the format of the data. In this case XML data is not canonicalized. I am pretty sure that this leads to compatibility problems. I wonder how others that implement XMLERS deal with that.

Best regards
Markus


From: [e-mail] [mailto:[e-mail]] On Behalf Of Tobias Gondrom
Sent: Donnerstag, 26. April 2012 12:02
To: [e-mail]
Subject: Re: [ltans] Canonicalization

Hi Markus,

actually section 3.2.2 is referring to the Reduction of Hash Tree. From you question I assume you meant to refer to section 3.2 item 2.

Please be advised, that if you store archive objects in XML data without canonicalization, you have a significant risk that the order of elements may be rearranged by parsers when read/edited and the bit representation of the data may change and will therefor no longer correspond to previously calculated hash values.
Therefore it is important to make sure XML data is canonicalized before it enters the system. Mainly consider scenarios where a client may want to intergrate the XMLERS into the same XML data structure and later obviously must remove it from the structure before it can be verified.
(on a side note: btw. pure XML data format alone is in general suboptimal for long-term non-repudiation of documents, as it may also require stylesheets to achieve reproducible representation of the data.)

So if you put XML data into the system and want to use some of the special properties of XML (i.e. allowing to integrate the XMLERS afterwards into the XML document itself and removing it prior to verification) you MUST canonicalize it to make sure your bit representation will always remain consistent after these operations.

However, from a technical perspective you can equally treat it as a data blob (agnostic to the format). So you can treat it as bits and bytes unaware of any file format.

Best regards, Tobias




On 25/04/12 16:41, Markus Isler wrote:
Hi

I have a question regarding Canonicalization of XML elements. According to 3.2.2 archive data has to be canonicalized before hashing it.

Supposed we are archiving files of arbitrary format. Does this mean that we have check each file whether it is a valid XML file? I hope this is not the case.

Regards
Markus





_______________________________________________

ltans mailing list

[e-mail]<mailto:[e-mail]>

https://www.ietf.org/mailman/listinfo/ltans