OpenSAML java withcomments canonicalization

[Cantor, Scott]

> Based on https://issues.shibboleth.net/jira/projects/OSJ/issues/OSJ-230 I
> understand that I can't specify the transform c14n algorithm, and that c14n
> w/o comments is always used when signing in openSAML.

That's not the case if you do it by hand. Shibboleth does not have the ability to override the transform because it does not, and will not, call those APIs directly. Anybody else can do anything they want to do if they manipulate it directly with those APIs.

> I'm trying to understand the reverse. Suppose I try to use openSAML to validate a
> signature (e.g. generated by some other library that does allow c14n w/
> comments as the transform) that produced the following:

The mechanical validation of the signature, which is not done by OpenSAML, that's Santuario, is done based on whatever the message contains. If it says use Transform X, then that's what is done, provided the library supports it and doesn't have some kind of policy blocking it.

> When the digest of ref #73651ce4-0ee9-4452-b063-c70657fb99dc is
> recalculated for validation purposes within openSAML, will the c14n w/
> comments algorithm specified in the transform be used or will c14n w/o
> comments be used?

The one in the Transform is used. If the last Transform in the chain produced a node set, then I believe XML Signature mandates that the final octet stream be generated by applying *another* c14n, the algorithm for which I don't recall, it's in the standard. If the final Transform is c14n itself, then my understanding is that it produces an octet stream directly and therefore should be consumed into the digester as is, not manipulated again.

-- Scott