Dear all readers and researchers,
I'm quite new to Security, and I am working with JSR 105/106 (DSig and
Enc).
Recently, I've read a writing by Peter Gutmann
http://www.cs.auckland.ac.nz/~pgut001/pubs/xmlsec.txt,
in which from
what I have understood, Peter has pointed out that:
---------------------------
+ Canonicalisation is too hard, X.509 abandoned it, no hope for
XMLDSig
+ XML is complicated: XSLT, XPath, DTD difficult to simply describe
what should be a secure solution for XML
+ XML is too much flexible
One can sign the do***ent header
One can sign an empty string
There are key exchange mechanisms where a message can contain embedded
keys before or after the secured payload (Still don't understand)
+ XML is also too much inflexible
Can you separate a security component from an XML component ?
Not many XMLSec provider is both good at security or XML, but you have
to use whatever that provider gives you
+ Good non-XMLSec solutions (PGP & S/MIME) organizes blocks of data so
as to avoid buffering of big data when verifying/encrypting:
- Encryption:
Recipient/Key-exchange information
Encrypted Data
- Signature:
Signature Hash Algorithm Indicator
Data
Signature
+ XMLSec tries to be different, by allowing data blocks to be of
arbitrary orders.
---------------------------
This writing was 2 years old (From 2005), and I still see XML Security
developed by Sun, Apache and IAIK ?
So could anyone of you telling me what the world is really thinking on
XML DSig and Encryption ?
Thanks alot for your time
|
