Can you help me successfully validate the signature of an assertion?

[Brent Putman]

On 6/4/15 4:20 AM, Richard Mundell wrote:
>
>  We’d assumed that the formatting (tabs, carriage returns, etc) of
> the XML wasn’t important. After all, the signature is being checked
> against a Document object hierarchy rather than the String
> representation, and it’s not an unreasonable assumption that none of
> the formatting gets carried over into the object representation.
>
>

It's not terribly unreasonable to think that, but unfortunately none of
the canonicalization (c14n) algorithms defined for XML Signature
actually work that way.  Often people assume that you are signing the
"logical XML document", but it's not the case.  Ultimately the signing
process has to produce essentially a byte array (some serialization of
the XML) as input to a digest algorithm.  None of the existing c14n
algorithms do this kind of normalization of whitespace inside element
content, in part because it would be problematic for such an algorithm
to make assumptions about what whitespace is semantically significant
vs not.  Same with namespace prefixes.  

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150604/890c5b6b/attachment.html>