Why requiring --certificate when verifySignature?

[Ian Young]

> On 2020-10-09, at 00:55, Weiwu Zhang <weiwu.zhang at alphawallet.com> wrote:
> 
> Through your explanation now I understood that
> typically xmlsectool is used in a context where the verifier has the
> right certificate (instead of a trusted authority list).

Yes. The principal real world use case for xmlsectool is for the secure exchange of the large aggregate documents holding national or international federation metadata. The trust model is very tightly controlled (much more so than the typical public web PKI use of signatures) and does essentially boil down to "must be that specific key".

As Scott says, XML DSIG in general can be a *lot* more complicated than that, and xmlsectool doesn't aim to handle more than a small number of specific use cases.


> That is, unless, if xmlsectool already support certificate chain where
> I can actually supply a chain certificate in --verifySignature
> --certificate and it will check against the public key used to sign
> the certificate in XMLDSIG instead of the public key used to sign the
> XML. I haven't experiemented that kind of use.

No, it doesn't support that, and there are no plans for that to change.

Cheers,

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20201009/0879eeb9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20201009/0879eeb9/attachment.p7s>