Can we have the option of not canonicalising the signed XML file?
Weiwu Zhang
weiwu.zhang at alphawallet.com
Tue Sep 29 02:13:09 UTC 2020
If I undrestood XMLDSIG correctly, the signature is applied on the digest
of the node, which is canonicalised, but it doesn't have to be enveloped
in a canonicalised file.
That is, it should be possible to append signature to an XML without
changing other parts of the XML file at all and it would still be valid.
This is important in the case the XML file needs to be viewed or, that it
contains errors that can only be captured at run time, and not
schema-detectable - in our use-case, you need blockchain data to figure
out if there is an error in an XML file that describes a blockchain token.
In such cases, it's important to report a line number of the error that
the developers can use to trace in their original, unsigned XML file.
If such an option is possible, I actually feel it should be the default.
XML use-cases are already complicated and having to deal with the
canonicalised form is another burden on the learning curve. Making it
transparent is one less things to keep in mind for the developers.
Besides, why would enveloped and external xmldsig be any different (where
the external one didn't require you to change the file structure, but the
enveloped one resulted in dramatically changed canonicalised form).
Thanks for the great work by the way! Love from Sydney, Australia.
More information about the dev
mailing list