<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 6/4/15 4:20 AM, Richard Mundell
wrote:<br>
</div>
<blockquote
cite="mid:BN3PR0601MB1299B336C1D69F098E536E83E8B30@BN3PR0601MB1299.namprd06.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Tahoma","sans-serif";
font-variant:normal !important;
color:windowtext;
text-transform:none;
text-decoration:none none;
vertical-align:baseline;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Tahoma","sans-serif";
font-variant:normal !important;
color:black;
text-transform:none;
font-weight:normal;
font-style:normal;
text-decoration:none none;
vertical-align:baseline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Tahoma","sans-serif";
font-variant:normal !important;
color:black;
text-transform:none;
font-weight:normal;
font-style:normal;
text-decoration:none none;
vertical-align:baseline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"> We’d
assumed that the formatting (tabs, carriage returns, etc) of
the XML wasn’t important. After all, the signature is being
checked against a Document object hierarchy rather than the
String representation, and it’s not an unreasonable
assumption that none of the formatting gets carried over
into the object representation.</span><br>
</p>
</div>
<br>
</blockquote>
<br>
It's not terribly unreasonable to think that, but unfortunately none
of the canonicalization (c14n) algorithms defined for XML Signature
actually work that way. Often people assume that you are signing
the "logical XML document", but it's not the case. Ultimately the
signing process has to produce essentially a byte array (some
serialization of the XML) as input to a digest algorithm. None of
the existing c14n algorithms do this kind of normalization of
whitespace inside element content, in part because it would be
problematic for such an algorithm to make assumptions about what
whitespace is semantically significant vs not. Same with namespace
prefixes. <br>
<br>
</body>
</html>