Why requiring --certificate when verifySignature?

[Weiwu Zhang]

Okay thanks Ian for the explanation. And you are right that the
integrity is not effectively checked unless the verifier has either
the signer's public key (or a way to assert public key) or some shared
secret (HMAC) prior.

In my case, the validity of the certificate can't be asserted directly
through a certificate, but rather a trusted CA list that is known to
the verifier. So what I would wish to see is that verifySignature
shows the certificate details so I can match the signer of the
certificate with a known list instead of match the XML signer against
a known certificate. In a sense I separated signature validity and
trustworthiness - you can have a correctly signed email for example
but it's up to me if I trust the signature by looking at if your
public key is registered or if it carries a certificate that is in my
known authority list.

I understand that xmlsectool has no obligation to satisfy anyone's
need other than the consortiums' (it's open source anyway and it's
great that it is there). However, without explaining my work context
and seeing you response, it's hard to see whether or not my context
are the same as yours. Through your explanation now I understood that
typically xmlsectool is used in a context where the verifier has the
right certificate (instead of a trusted authority list).  There are
not a lot of xml security use cases today so it's hard to be sure if
my case is an extreme or norm.

That is, unless, if xmlsectool already support certificate chain where
I can actually supply a chain certificate in --verifySignature
--certificate and it will check against the public key used to sign
the certificate in XMLDSIG instead of the public key used to sign the
XML. I haven't experiemented that kind of use.


regards