<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 2020-10-08, at 12:00, Weiwu Zhang via dev <<a href="mailto:dev@shibboleth.net" class="">dev@shibboleth.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">If the certificate is already in the XMLDSIG, the tool only need to<br class="">validate if the signature matches the key provided in the certificate<br class="">in the signature, right?</div></div></blockquote><div><br class=""></div><div>You need some external trust root to be provided for the signature to be anything other than an indication of integrity.</div><div><br class=""></div><div>To use a signature as an indication of _authenticity_, you need to provide an _external_ indication of the key associated with the expected signing entity. That's why you provide an external credential (from a certificate, a PKCS#11 token or a Java keystore).</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">Adding --certificate only make sure that the signature is validated<br class="">against the pubkey contained in the --certificate, instead of the one<br class="">contained in the certificate in the XMLDSIG. Which IMHO doesn't make<br class="">it a mandantory parameter.<br class=""></div></div></blockquote><div><br class=""></div><div>Well, if you trust the credential included in the signature, you're open to being fed a document signed by an attacker who uses an arbitrary key and wraps it in a self-made certificate. As I say above, you might argue that this would give you integrity protection but it's useless for verifying authenticity, which is what we're interested in here and what xmlsectool is designed to provide.</div><div><br class=""></div><div><span style="font-size: 12px; orphans: 2; widows: 2; -webkit-text-decorations-in-effect: none;" class=""> -- Ian</span></div></div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px; -webkit-text-decorations-in-effect: none;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""><span class="Apple-style-span" style="font-size: medium;"><br class=""></span></div></span></div></span><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>