Subject: XML Signing notes from Ft. Lauderdale

From: "Kent M. Davidson" <[email-masked]>
Date: Mon, 15 Feb 1999 15:10:14 -0800

Enclosed is the notes I took in Ft. Lauderdale re: the XML signing changes we discussed. I'm working with Richard Brown to finalize the changes and start working on the addendum for IOTP.

-Kent.

P.S. There are various notes within the notes marked by ### as possible changes...
---
<!ELEMENT OTPSignatures (Signature+,Certificate*)>
    <!ELEMENT Signature (Manifest, SignatureValue+) >
    <!ELEMENT SignatureValue (#PCDATA)>
    <!ATTLIST SignatureValue
        encoding    (none | base64) #IMPLIED 'none'
        ID          ID              #REQUIRED
        <!ELEMENT dsig:Manifest (
            dsig:Algorithm+,
            dsig:Digest+, 
            dsig:Attributes?, 
            dsig:OriginatorInfo,
            dsig:RecipientInfo+,
        )
        <!ATTLIST dsig:Manifest
            LocatorHRefBase     CDATA   #IMPLIED
            <!ELEMENT dsig:Algorithm (dsig:Parameter*)>
            <!ATTRLIST dsig:Algorithm
                xmlns:dsig      PCDATA                          #FIXED    %xmldsig.dtd;
                type            (digest|signature|keyagreement)   #OPTIONAL
                name            NMTOKEN                         #REQUIRED
                ID              ID
            <!ELEMENT dsig:Digest (#PCDATA)>
            <!ATTLIST dsig:Digest   
                LocatorHREF         NMTOKEN
                DigestAlgorithmRef  CDATA
                encoding            (none | base64)
            <!ELEMENT dsig:Attributes (Attribute+)> 
            <!ATTLIST dsig:Attribute
                xmlns:disg    CDATA       #FIXED        %xmldsig.dtd;
                type          NMTOKEN     #REQUIRED
                critical ( true | false ) #REQUIRED    'false'
###         <!ELEMENT dsig:IOTPSignatureType EMPTY> 
###                 IOTP SigType = Other, Payment, Delivery
            <!ELEMENT dsig:OriginatorInfo ANY>
            <!ATTLIST dsig:OriginatorInfo 
                OriginatorRef           NMTOKENS    #OPTIONAL
            <!ELEMENT dsig:RecipientInfo ANY>
            <!ATTLIST dsig:RecipientInfo 
                SignatureAlgorithmRef   IDREF       #REQUIRED
                SignatureValueRef       IDREF       #REQUIRED
###             RecipientRef            NMTOKENS    #OPTIONAL
            <!ELEMENT dsig:Parameter ANY>
            <!ATTLIST dsig:Parameter
                xmlns:dsig    PCDATA    #FIXED    %xmldsig.dtd;
                type          PCDATA    #REQUIRED
            <!ELEMENT dsig:Certificate (
                dsig:IssuerAndSerialNumber,
                ( dsig:Value | dsig:Locator )
            )>
            <!ATTLIST dsig:Certificate
                xmlns:disg    CDATA      #FIXED    %xmldsig.dtd;
                type          NMTOKEN    #REQUIRED
            <!ELEMENT dsig:IssuerAndSerialNumber EMPTY >
            <!ATTLIST dsig:IssuerAndSerialNumber
                xmlns:disg    CDATA    #FIXED    %xmldsig.dtd;
                issuer        CDATA    #REQUIRED
                number        CDATA    #REQUIRED
            <!ELEMENT dsig:Value ( #PCDATA )>
            <!ATTLIST dsig:Value
                xmlns:disg      CDATA      #FIXED    %xmldsig.dtd;
                encoding ( base64 | none ) #REQUIRED 'none'

Algorithm type='digest':
- "urn:ibm:dom-hash"
- "urn:fips:sha1"
- "urn:rsa:md5"

- "urn:rsa:md4"
- "urn:rsa:md2"
- RIPE?

ParameterType="AlgorithmRef"

Algorithms type='signature':
- "urn:us.gov:dsa"
- "urn:ibm:hmac"
- "urn:rsa:rsa"

e.g.
<dsig:Algorithm ID=A1 type="digest" name="urn:ibm:dom-hash">
    <dsig:Parameter type='AlgorithmRef'>A2</Parameter>
</dsig:Algorithm>
<dsig:Algorithm ID=A2 type="digest" name="urn:fips:sha1">
</dsig:Algorithm>
<dsig:Algorithm ID=A3 type="signature" name="urn:???:hmac">
    <dsig:Parameter type='AlgorithmRef'>A1</Parameter>
</dsig:Algorithm>

TODO:
- Resolve URNs names...
- Parameters within all algorithms to point to "sub" algorithms
- Other parameters specific to digest and signature algorithms

Changes:                
- Issue of removing "Digest" completely?
- How affects Authentication in IOTP
- Locator removal -> HREF within Resource
- Resource+, eliminates Resources
- HREFBASE added in ATTLIST in Manifest
- Eliminate Date, KeyAgreement, Package, DigestAlg, ContentType
- Certificates moved to beneath Signatures?

- Removal of repetition of digest algorithms within digest
- Multiple signature values for a single manifest
- Once you remove DigestAlgorithm
- Locator has 1 useful attribute, not really needed
- ContentType optional as well
- KeyAgreement not "removed", just arranged, commonality among all algs

990210
------
Discussions:
- Moving all algorithms to one place
- Having multiple signatures for multiple recipients
- Cases sensitivity of example above where 'case-sensitive' ID=A2 and <Param>a2</Param> 
    may be parsed by different parts of the application.
- Hitachi wants references to be IDREFs within Algorithm

___________________________________________
Kent M. Davidson, VP of Advanced Technology
Differential, Inc.
direct (408)864-0604 
fax    (408)864-0601             
mailto:[email-masked]
http://www.differential.com

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]