You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by pa...@devoteam.com on 2002/11/28 18:49:45 UTC
Problem with namespace management
Hi,
I have a problem with the validation of a signature.
1) When I pass this document :
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:CanonicalizationMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
... />
<ds:SignatureMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ... />
<ds:Reference URI="#Body" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
...
All XML element have the namespace reference xmlns:ds
="http://www.w3.org/2000/09/xmldsig#"
And the signature is not valid.
2) Whereas I pass this document :
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo ...> no attibute xmlns:ds="..."
<ds:CanonicalizationMethod ... /> no attibute xmlns:ds="..."
<ds:SignatureMethod ... /> no attibute xmlns:ds="..."
<ds:Reference URI="#Body">
...
The signature is valid.
Thanks for your help.
Best Regards.
Re: Problem with namespace management
Posted by Christian Geuer-Pollmann <ge...@nue.et-inf.uni-siegen.de>.
--On Freitag, 29. November 2002 08:26 +0100 Thomas Kriegelstein
<tk...@mail.inf.tu-dresden.de> wrote:
> Am Donnerstag, 28. November 2002 18:49 schrieb
> pascal.recchia@devoteam.com:
>> <ds:Reference URI="#Body" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>
> Do you use an enveloped, enveloping or stand alone signature?
>
> Christian, if one uses signatures in stand alone mode, is the referenced
> document treated as xml, or just as byte[]? How do you figure out, that
> it is indeed xml, do you try to parse it?
In the above example, the URI="#Body", therefore it refers to the
same-document URI #Body and so the de-referenced contents are octets. If
you refer to URI="1.xml", the de-referenced contents are octets, but if you
apply a transform which requires a node-set, a parsing process is done. See
spec for details.
Christian
Re: Problem with namespace management
Posted by Thomas Kriegelstein <tk...@mail.inf.tu-dresden.de>.
Am Donnerstag, 28. November 2002 18:49 schrieb pascal.recchia@devoteam.com:
> Hi,
>
> I have a problem with the validation of a signature.
>
> 1) When I pass this document :
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:CanonicalizationMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
> ... />
> <ds:SignatureMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ... />
> <ds:Reference URI="#Body" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> ...
>
> All XML element have the namespace reference xmlns:ds
> ="http://www.w3.org/2000/09/xmldsig#"
>
> And the signature is not valid.
>
>
> 2) Whereas I pass this document :
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo ...> no attibute xmlns:ds="..."
> <ds:CanonicalizationMethod ... /> no attibute xmlns:ds="..."
> <ds:SignatureMethod ... /> no attibute xmlns:ds="..."
> <ds:Reference URI="#Body">
> ...
> The signature is valid.
Do you use an enveloped, enveloping or stand alone signature?
Christian, if one uses signatures in stand alone mode, is the referenced
document treated as xml, or just as byte[]? How do you figure out, that it is
indeed xml, do you try to parse it?
Cu,
Thomas
Re: Problem with namespace management
Posted by Christian Geuer-Pollmann <ge...@nue.et-inf.uni-siegen.de>.
Hi Pascal,
this seems curious:
<a:foo xmlns:a="http://a.com/">
<a:bar xmlns:a="http://a.com/" />
</a:foo>
is exactly the same as
<a:foo xmlns:a="http://a.com/">
<a:bar />
</a:foo>
so it *CANNOT* be that a signature between these two forms is different.
There must be something else which changes. These superflous namespace
declarations cannot pose a problem.
Christian
--On Donnerstag, 28. November 2002 18:49 +0100 pascal.recchia@devoteam.com
wrote:
> Hi,
>
> I have a problem with the validation of a signature.
>
> 1) When I pass this document :
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:CanonicalizationMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
> ... />
> <ds:SignatureMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ... />
> <ds:Reference URI="#Body" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> ...
>
> All XML element have the namespace reference xmlns:ds
> ="http://www.w3.org/2000/09/xmldsig#"
>
> And the signature is not valid.
>
>
> 2) Whereas I pass this document :
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo ...> no attibute xmlns:ds="..."
> <ds:CanonicalizationMethod ... /> no attibute xmlns:ds="..."
> <ds:SignatureMethod ... /> no attibute xmlns:ds="..."
> <ds:Reference URI="#Body">
> ...
> The signature is valid.
>
> Thanks for your help.
> Best Regards.
>
RE: Problem with namespace management
Posted by Matteo Artuso <ma...@unimaticaspa.it>.
because subtree inherit namespace from father.
M@
> -----Original Message-----
> From: pascal.recchia@devoteam.com [mailto:pascal.recchia@devoteam.com]
> Sent: Thursday, 28 November, 2002 18:50
> To: security-dev@xml.apache.org
> Subject: Problem with namespace management
>
>
> Hi,
>
> I have a problem with the validation of a signature.
>
> 1) When I pass this document :
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:CanonicalizationMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
> ... />
> <ds:SignatureMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" ... />
> <ds:Reference URI="#Body" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> ...
>
> All XML element have the namespace reference xmlns:ds
> ="http://www.w3.org/2000/09/xmldsig#"
>
> And the signature is not valid.
>
>
> 2) Whereas I pass this document :
> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo ...> no attibute xmlns:ds="..."
> <ds:CanonicalizationMethod ... /> no attibute xmlns:ds="..."
> <ds:SignatureMethod ... /> no attibute xmlns:ds="..."
> <ds:Reference URI="#Body">
> ...
> The signature is valid.
>
> Thanks for your help.
> Best Regards.
>
>