Subject: I-D Action: draft-wrapping-attack-mitigation-00.txt

From: [email-masked]
Date: Fri, 16 Feb 2018 01:18:44 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : A modified XML Signature algorithm to mitigate XML Digital Signature wrapping attacks
        Authors         : Jitendra Kumar
                          Balaji Rajendran
                          Bindhumadhava BS
	Filename        : draft-wrapping-attack-mitigation-00.txt
	Pages           : 8
	Date            : 2018-02-16

Abstract:
   XML signature standard (described in RFC3275 [RFC3275])defined by
   IETF/W3C references or identifies signed elements by their unique
   identities specified by "id" attribute values in the given XML
   document.  Hence, signed XML elements can be shifted from one
   location to another location in a XML document, and still, it does
   not have any effect on its ability to verify its signature.  This
   flexibility paves the way for an attacker to tweak original XML
   message without getting noticed by the receiver.  This document
   proposes to use absolute XPath as an "Positional Token" and modifies
   XML Signature algorithm to overcome the XML Signature wrapping
   attacks on XML signatures.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-wrapping-attack-mitigation/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-wrapping-attack-mitigation-00
https://datatracker.ietf.org/doc/html/draft-wrapping-attack-mitigation-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/