How to validate signature that uses older XML canonicalization

[Cantor, Scott]

On 1/19/12 5:51 PM, "Yang, Gang CTR (US)" <gang.yang.ctr at mail.mil> wrote:
>some debugging, I found OpenSAML library is complaining about the
>Transform Algorithm used by the other party's implementation. The
>Transform Algorithm used by the other party's implementation is
>"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#"
> in stead of that used by OpenSAML library, which is
>"http://www.w3.org/2001/10/xml-exc-c14n#".

It's technically permissible, but strongly discouraged, to use transforms
other than the specific two identified in the specification.
Implementations are free to reject any others they find, because that
allows them to ensure that the content is properly signed. when this is
not done, or done wrong, you get wrapping attacks.

> 
>Now my question is that is there a way to configure OpenSAML library to
>also accept the "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#"
>version of C14N?

Inclusive c14n as a Reference Transform in SAML is essentially wrong by
definition. It means the signature depends on the surrounding context
outside the object being signed. It's not necessarily much different in a
protocol message, but signing an assertion that way is definitely wrong.
That said, you can implement your own profile validator if you want to.
But I wouldn't.

-- Scott