[jira] Commented: (SANTUARIO-261) incorrect digest of document that mixes enveloping and detached signatures

["sean.mullan (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SANTUARIO-261?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12978363#action_12978363 ] 

sean.mullan commented on SANTUARIO-261:
---------------------------------------

As Arshad points out in the forum discussion, we only support References in a Manifest element if the Manifest is referenced directly, and not if it is inside an Object element. That said, it shouldn't be too difficult to fix this, so I will see if that can be fixed for the next release. However, I should point out that none of the XML Signature interoperability tests tested this specific use case, and the example in the XML Signature recommendation references the Manifest element directly: http://www.w3.org/TR/xmldsig-core1/#sec-o-Manifest

So, I think you may find that implementations don't support this consistently. 

> incorrect digest of document that mixes enveloping and detached signatures
> --------------------------------------------------------------------------
>
>                 Key: SANTUARIO-261
>                 URL: https://issues.apache.org/jira/browse/SANTUARIO-261
>             Project: Santuario
>          Issue Type: Bug
>          Components: Java
>         Environment: Tested in Windows, with the most recent Java version.
>            Reporter: Luis Bernardo
>            Assignee: sean.mullan
>
> The issue is described here: http://forums.oracle.com/forums/thread.jspa?threadID=2148599&tstart=0
> You can run the sample in the link above and then run the Validate program over the result.
> The problem is due to the fact that the digest calculated for the object is incorrect as the logging seems to indicate:
> FINER: Pre-digested input:
> Jan 5, 2011 11:42:52 PM org.jcp.xml.dsig.internal.DigesterOutputStream write
> FINER: <Object xmlns="http://www.w3.org/2000/09/xmldsig#" Id="object"><Manifest><Reference URI="http://www.w3.org/TR/xml-stylesheet"><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></DigestMethod><DigestValue></DigestValue></Reference></Manifest></Object>
> The digest element of the reference is missing from the object. Hence the digest of the object will be incorrect and fail validation. However in the final document the the digest of the reference is present and is correct.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.