Subject: RE: How to sign several resources (XML and XSL)?

From: Greg Whitehead <[email-masked]>
Date: Wed, 22 Sep 1999 16:12:57 -0700

Where XML is being used in the context of a wire protocol, and there is no
XSL style sheet used in the interpretation of the messages by the protocol
engine, it shouldn't be necessary to include any XSL in the signature.

In general, you need to look at the context in which signed data is being
interpreted and be sure that all of the elements critical to the
interpretation can be trusted (were signed or obtained securely from some
trusted source).

-Greg

-----Original Message-----
From: DJ [mailto:[email-masked]]
Sent: Wednesday, September 22, 1999 3:49 PM
To: David Burdett; Winchel 'Todd' Vincent, III; Andreas Siglreithmayr;
W3c-Ietf-Xmldsig (E-mail)
Cc: IETF Trade (E-mail)
Subject: RE: How to sign several resources (XML and XSL)?

UWI.com has an XML implementation that signs the "presentation" (eg. the
XSL)
as well as the XML.  In their view, it is critically important to sign
both, otherwise
how do you know the context for the XML data?  

dj

At 02:45 PM 9/22/99 -0700, David Burdett wrote:
>Following on from this I'm wondering what people's views are on signing an
>XML document that is primarily an XML representation of a data structure
>that is defined in a specification that is widely and publically available.
>
>The XML document, in it's native form is readable but not easily
>understandable. A style sheet would make the document easier to understand
>but is not required since the semantics of the document are defined in the
>specification. However could use of a stylesheet then be construed as
>altering the meaning of the XML document as far as a recipient is
concerned.
>
>I ask since this is what IOTP effectively does, it signs several parts of a
>data structure (represented in XML) and then creates new data structures
>from the orginal that are also digitally signed and, using additional
>"endorsing" signatures, "binds" the new document back to the original.
>
>David
>
>-----Original Message-----
>From: Winchel 'Todd' Vincent, III [mailto:[email-masked]]
>Sent: Wednesday, September 22, 1999 1:43 AM
>To: Andreas Siglreithmayr; W3c-Ietf-Xmldsig (E-mail)
>Subject: Re: How to sign several resources (XML and XSL)?
>
>
>>
>> I think that if someone signs an XML-document, s/he would also have
>>to sign the corresponding XSL file.
>
>Andreas:
>
>Other people on this list hold the very same opinion.  Indeed, as an
>American lawyer, I believe there are very good legal reasons why *not*
>signing the stylesheet might just get and XML document thrown out of court
>if/when it were introduced into evidence.  Such a result would, of course,
>make the technology much less valuable.
>
>Thank you for your input.  I think having someone with a new and fresh
>perspective helps to shed light on the simplicity and logic of the notion.
>I wish others would see it so clearly.
>
>Todd
>

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]
-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: David Burdett <[email-masked]>
Date: Wed, 22 Sep 1999 20:36:52 -0700

I agree ... but in IOTP the XML data can include an offer that says, for
example, "purchase a widget for $10". This offer can be expressed in XML
(with a style sheet if required), HTML or plain text. However the buyer
needs to be "presented" with the offer to decide whether or not to accept
it. The offer can also be signed for the usual reasons such as:
- tamper resistance
- to authenticate the creator

So really there's a mixture of wire protocol and human intepretation ...

David

-----Original Message-----
From: Greg Whitehead [mailto:[email-masked]]
Sent: Wednesday, September 22, 1999 4:13 PM
To: 'DJ'; David Burdett; Winchel 'Todd' Vincent, III; Andreas
Siglreithmayr; W3c-Ietf-Xmldsig (E-mail)
Cc: IETF Trade (E-mail)
Subject: RE: How to sign several resources (XML and XSL)?

-Greg

-----Original Message-----
From: DJ [mailto:[email-masked]]
Sent: Wednesday, September 22, 1999 3:49 PM
To: David Burdett; Winchel 'Todd' Vincent, III; Andreas Siglreithmayr;

dj

concerned.

---

From: "Milton M. Anderson" <[email-masked]>
Date: Thu, 23 Sep 1999 00:35:18 -0400

-----Original Message-----
From: David Burdett <[email-masked]>
Date: Wednesday, September 22, 1999 11:39 PM
Subject: RE: How to sign several resources (XML and XSL)?

>... otherwise how do you know the context for the XML data?
>
>You know the context because interpretation of the XML data is being done
by
>software from a presumably reliable source to do the interpretation that is
>built according to a specification that describes the semantics of data
>
>... I now feel that we're getting very close to the topic of "trusted"
>applications  and I'm not sure we want to go there ...

Even if XSL is signed, you still have to assume a "trusted" browser.
It's impossible not to go there...

Milt

---

From: Ed Simon <[email-masked]>
Date: Wed, 22 Sep 1999 19:26:56 -0400

When someone signs something, I would imagine that he/she would
be looking at some sort of visual contract at the time.  Ideally,
one would want to sign enough of the "presentation mechanism" to
be able to re-create as closely as possible the appearance of
that contract later (perhaps for legal purposes).

Stylesheets provides an excellent way of capturing the presentation
of XML-encoded data.  It would seem to me that many applications
might want to consider using XSL for this purpose and would then
sign the XSL use to present the XML data also being signed.

Of course, the visual appearance may be affected by other factors
such as the limitations of the browser (did that version process
the stylesheet properly?) and the physical device.
One would also have to make sure there could be no unresolved
external entities that could be disputed later
(eg. don't sign "&bank;", sign the value of
the entity, eg. "Bank of Bells Corners").

I don't recall if it has been mentioned yet on this archive
but our own Joseph Reagle has a recent paper entitled
"Eskimo Snow and Scottish Rain*:
Legal Considerations of Schema Design"
(see "http://www.w3.org/TR/md-policy-design").

Regards, Ed

-----Original Message-----
From: David Burdett [mailto:[email-masked]]
Sent: September 22, 1999 5:46 PM
To: Winchel 'Todd' Vincent, III; Andreas Siglreithmayr; W3c-Ietf-Xmldsig
(E-mail)
Cc: IETF Trade (E-mail)

altering the meaning of the XML document as far as a recipient is concerned.

David

-----Original Message-----
From: Winchel 'Todd' Vincent, III [mailto:[email-masked]]
Sent: Wednesday, September 22, 1999 1:43 AM
To: Andreas Siglreithmayr; W3c-Ietf-Xmldsig (E-mail)
Subject: Re: How to sign several resources (XML and XSL)?

Andreas:

Todd

---

From: [email-masked]
Date: Thu, 23 Sep 1999 13:44:54 -0400

Proof in court depends on all kind of factors, many of which never appear in any
computer readable form.   As long as we provide ways for people to sign digital
objects, they can include under the signatre, directly or indirectly, anything
they want including anything they think might be helpful for later proofs.  If
someone wants to write a draft in the XMLDSIG group on the topic of what you
might want to sign in conjuction with a document for such legal purposes, they
are welcome to do so, but I don't see this as having a lot to do with our task
of defining XML digital signature syntax and processing.  Nor do I see these
questions as having much to do with IOTP where most signatures having nothing to
do with human sensible documents but rather with highly stylized protocol
messages.

Donald

Donald E. Eastlake, 3rd
17 Skyline Drive, Hawthorne, NY 10532 USA
[email-masked]   tel: 1-914-784-7913, fax: 1-914-784-3833

home: 65 Shindegan Hill Road, RR#1, Carmel, NY 10512 USA
[email-masked]   tel: 1-914-276-2668

DJ <[email-masked]> on 09/23/99 12:21:06 PM

To:   David Burdett <[email-masked]>, "Winchel 'Todd' Vincent,
      III" <[email-masked]>, Andreas Siglreithmayr
      <[email-masked]>, "W3c-Ietf-Xmldsig (E-mail)"
      <[email-masked]>
cc:   "IETF Trade (E-mail)" <[email-masked]>
Subject:  RE: How to sign several resources (XML and XSL)?

But to present legally binding evidence at a future date you may need to
present the signed XML, the presentation (signed XSL) and perhaps even
the application that displayed it (a signed copy of Netscape??? or perhaps
the UWI.com forms browser?)

DJ

At 08:36 PM 9/22/99 -0700, David Burdett wrote:
>You know the context because interpretation of the XML data is being done by

---

From: [email-masked]
Date: Thu, 23 Sep 1999 10:42:01 -0600

XSL is an XML format, so we haven't excluded signature of XSL, have we? Also,
I'm aware of the W3C recommendation at

http://www.w3.org/TR/xml-stylesheet/

that ties a stylesheet to an XML document.  However, a processing instruction is
used for this purpose, and we have proposed elimination of PI from our c14n.  I
believe this needs to be revisited.  Applications will definitely want the
option to locate and sign an associated stylesheet.  IMO, It is not for us to
judge whether or not this makes sense to the application just because our
committee(s) can't guarantee a trusted browser.  The level of trust required is
up to the application (they may restrict their application to specific signed
and trusted browsers, they may certify their application for specific common
browsers, etc.)

Rich

____________________Reply Separator____________________
Subject:    Re: How to sign several resources (XML and XSL)? 
Author: "Milton M. Anderson" <[email-masked]>
Date:       9/23/99 7:44 AM

-----Original Message-----
From: David Burdett <[email-masked]>
Date: Wednesday, September 22, 1999 11:39 PM
Subject: RE: How to sign several resources (XML and XSL)?

by

Milt

---

From: Ed Simon <[email-masked]>
Date: Thu, 23 Sep 1999 13:37:50 -0400

Just as signing an entity like "&bank;" may not be sufficient
when the user actually sees "Bank of Bells Corners", signing
a link to stylesheet may also be insufficient.

Though an XML instance can specify one or more stylesheets
(using the Recommendation Rich links to), that does not
mean applications will actually
use one of those stylesheets when formatting the
data for a user.  For example, it is predicted that PCs will
make up less than half of the devices connect to the Internet
by 2002 (others would include handheld devices like PalmPilots
and cell-phones (with mini screens like those on modern
video cameras).  To accomodate the wide range of output devices,
vendors are looking at dynamically selecting the stylesheet
based on the output device.  So, if you want to trade stocks
using a cell-phone's mini screen, the stock-trade-to-cell-phone
stylsheet would be used.  An application may then want to sign
that stylesheet used for that transaction rather than one of the
ones specified in the XML instance.

Anyway, I like the way Rich makes the point about the
"level of trust" being up to the application.  The XML
Signature spec may make it possible to sign things beyond
the core data but doesn't require one do so.  Applications
should sign whatever they believe is necessary.  For
legally-binding signatures, guiding principles might be
"beyond a reasonable doubt" or
"on the balance of probabilities".

Ed
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: September 23, 1999 12:42 PM
To: [email-masked]; [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re[2]: How to sign several resources (XML and XSL)? 

XSL is an XML format, so we haven't excluded signature of XSL, have we?
Also,
I'm aware of the W3C recommendation at

that ties a stylesheet to an XML document.  However, a processing
instruction is
used for this purpose, and we have proposed elimination of PI from our c14n.
I
believe this needs to be revisited.  Applications will definitely want the
option to locate and sign an associated stylesheet.  IMO, It is not for us
to
judge whether or not this makes sense to the application just because our
committee(s) can't guarantee a trusted browser.  The level of trust required
is
up to the application (they may restrict their application to specific
signed
and trusted browsers, they may certify their application for specific common
browsers, etc.)

Rich

-----Original Message-----
From: David Burdett <[email-masked]>
Date: Wednesday, September 22, 1999 11:39 PM
Subject: RE: How to sign several resources (XML and XSL)?

by

Milt

---

From: David Burdett <[email-masked]>
Date: Thu, 23 Sep 1999 20:53:14 -0700

... and even perhaps a digitally signed copy of the PC and operating system
on which it was run ?

Seriously though, if it comes to a court case I believe it's all a question
of being able to demonstrate, beyond a reasonable doubt, that the facts are
true which is a subjective opinion. I therefore thing that you probably
don't need signed copies of:
- the PC
- the operating system
- the browser and, I would content
- the style sheet ...

... as long as the style sheet was widely and publically available from
several sources and it was generally accepted as being a reasonable
presentation of the information in the XML document.

... but then I'm not a lawyer.

David

-----Original Message-----
From: DJ [mailto:[email-masked]]
Sent: Thursday, September 23, 1999 9:21 AM
To: David Burdett; Winchel 'Todd' Vincent, III; Andreas Siglreithmayr;

DJ

by