Previous XML Security WG News

2012-01-05: The XML Security Working Group has published a new Last Call Working Draft of "XML Encryption 1.1" to solicit review of changes since the previous CR publication. These changes:

1. make the AES-128-GCM algorithm mandatory to implement, to address newly publicized chosen-ciphertext attacks against the CBC class of algorithms,
2. add new security considerations related to chosen-ciphertext attacks, timing attacks, CBC block encryption vulnerabilities, and the insecure use of error messages,
3. add a new algorithm for the RSA-OAEP key transport that does not require SHA-1 with the mask generation function, enabling use of various hash MGF combinations, and
4. include various editorial corrections.

The XML Security WG is also soliciting review of the Last Call working draft of "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms". This specification brings the simplification benefits of the ongoing XML Security 2.0 effort to XML Encryption CipherReference transform processing. Feedback on both of these Last Call drafts is requested by 16 February 2012.

An update to the Note-track "XML Security Algorithm Cross-Reference" Working Draft reflects new algorithm definitions in XML Encryption 1.1.

The XML Security working group has also published First Public Working Drafts of "Test Cases for XML Encryption 1.1" and "Test Cases for Canonical XML 2.0" and encourages community participation in developing further tests and performing testing.

2011-08-30: Updated working draft of "XML Security RELAX NG Schemas" published. This version of this specification is significantly different from the previous version.

• The prose has been completely rewritten. In particular, Taxonomy of schemas, Schema authoring techniques, and Schema indexes have been introduced.
• xmldsig-filter2.rnc for XML-Signature XPath Filter 2.0 has been added.
• xmldsig11-schema.rnc has been modified by adding X509Digest and invoking xmldsig-filter2.rnc.
• Small bugs in xenc-schema-11.rnc and xmlsec-ghc-schema.rnc have been fixed.
• any.rnc has been renamed as security_any.rnc
• exclusiveC14N.rnc has been renamed as exc-c14n.rnc
• Driver schemas have been thoroughly renamed.

2011-08-09: Updated working draft of "XML Signature Best Practices" published. This draft

• Added a new best practice and example (section 2.1.4, XPath selection that causes denial of service in streaming mode)

• Added a new section containing a summary of the Best Practices (section 3)

• Incorporated editorial updates

2011-07-07: First Draft of "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms Specification" Published:

The XML Security Working Group has published a First Public Working Draft of "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" specification. This specification brings the benefits of the XML Signature 2.0 transform processing model to XML Encryption, reducing the attack surface and simplifying the processing model. Related 2.0 specifications are in Last Call, including XML Signature 2.0, Canonical XML 2.0 and the XML Signature Streaming Profile of XPath 1.0. The XML Security WG also has 1.1 specifications in Candidate Recommendation, including XML Signature 1.1, XML Encryption 1.1, XML Signature Properties, and XML Security Generic Hybrid Ciphers.

To address patent disclosures related to the XML Signature 1.1 and 2.0 and XML Encryption 1.1 specifications, W3C has chartered a Patent Advisory Group that is in progress. Learn more about W3C's Security Activity.

2011-04-26: Last Call: XML Signature, Canonicalization 2.0: The XML Security Working Group has published Last Call Working Drafts of XML Signature Syntax and Processing Version 2.0, Canonical XML 2.0, and XML Signature Streaming Profile of XPath 1.0. These specifications are part of an ongoing effort to rework XML Signature and Canonical XML to address issues around performance, streaming, robustness, and attack surface. With this Last Call, the Working Group is seeking broad feedback on the approach it has taken. Please comment by 24 May.

Additionally, the XML Security Working Group has updated Working Drafts of XML Security Algorithm Cross-Reference, XML Security 2.0 Requirements and Design Considerations, and XML Security RELAX NG Schemas documents. Learn more about XML.

2011-03-04: W3C Invites Implementer Feedback on XML Security 1.1 Specifications: The XML Security Working Group published four Candidate Recommendations today: XML Signature Syntax and Processing 1.1, XML Encryption Syntax and Processing 1.1, XML Security Generic Hybrid Ciphers, and XML Signature Properties. XML Signatures provide integrity, message authentication, and/or signer authentication services for data of any type, whether located within the XML that includes the signature or elsewhere. As companion documents, the Working Group has released new Working Drafts of XML Security 1.1 Requirements and Design Considerations and XML Security RELAX NG Schemas.

To address patent disclosures related to the XML Signature 1.1 and XML Encryption 1.1 specifications, W3C has chartered a Patent Advisory Group. Learn more about W3C's Security Activity.

2010-11-30: The XML Security Working Group has published a Last Call Working Drafts of XML Encryption Syntax and Processing Version 1.1 and XML Signature Syntax and Processing Version 1.1. The former specifies a process for encrypting data and representing the result in XML. The latter specifies XML digital signature processing rules and syntax. XML Signatures provide integrity, message authentication, and/or signer authentication services for data of any type, whether located within the XML that includes the signature or elsewhere. See the explanation of XML encryption changes and XML signature changes. Comments are welcome through 22 December.

2010-09-01: The XML Security Working Group has published five working drafts today. XML Signature 2.0, Canonical XML 2.0 and the XML Signature Streamable Profile of XPath 1.0 are part of an ongoing effort to rework XML Signature and Canonical XML in order to address issues around performance, streaming, robustness, and attack surface. The Working Group has also published updated Working Drafts for its XML Signature Best Practices and XML Security Relax NG Schemas Working Group Notes. Learn more about XML Security.

2010-05-13: The XML Security Working Group has published three Last Call Working Drafts: XML Encryption Syntax and Processing Version 1.1, XML Signature Syntax and Processing Version 1.1, and XML Security Generic Hybrid Ciphers. The group also published a Working Draft of XML Security Algorithm Cross-Reference. XML Encryption specifies a process for encrypting data and representing the result in XML. XML Signatures provide integrity, message authentication, and/or signer authentication services for data of any type, whether located within the XML that includes the signature or elsewhere. The third document augments XML Encryption by defining algorithms, XML types and elements necessary to enable use of generic hybrid ciphers in XML Security applications. The final document summarizes XML Security algorithm URI identifiers and the specifications associated with them. Last Call comments are welcome through 10 June. Learn more about the Security Activity.

2010-03-16: The XML Security Working Group published four Working Drafts today:

• XML Encryption Syntax and Processing Version 1.1, which specifies a process for encrypting data and representing the result in XML.
• XML Security RELAX NG Schemas, which serves to publish RELAX NG schemas for XML Security specifications, including XML Signature 1.1, and XML Signature Properties.
• XML Security Generic Hybrid Ciphers. This document augments XML Encryption Version 1.1 by defining algorithms, XML types and elements necessary to enable use of generic hybrid ciphers in XML Security applications. Generic hybrid ciphers allow for a consistent treatment of asymmetric ciphers when encrypting data and consist of a key encapsulation algorithm with associated parameters and a data encapsulation algorithm with associated parameters.
• XML Security Algorithm Cross-Reference, which summarizes XML Security algorithm URI identifiers and the specifications associated with them.

2010-03-05: The XML Security Working Group has published two Working Drafts: XML Signature Syntax and Processing Version 2.0 and Canonical XML Version 2.0. The first specifies XML syntax and processing rules for creating and representing digital signatures. XML Signatures can be applied to any digital content (data object), including XML. The second is a major rewrite of Canonical XML Version 1.1 to address issues around performance, streaming, hardware implementation, robustness, minimizing attack surface, determining what is signed and more. It also incorporates an update to Exclusive Canonicalization, effectively a 2.0 version, as well. Learn more about the Security Activity.

2010-02-04: The XML Security Working Group published two Last Call Working Drafts:

• XML Signature Syntax and Processing 1.1, which specifies XML syntax and processing rules for creating and representing digital signatures. XML Signatures can be applied to any digital content, including XML.
• XML Signature Properties, which outlines proposed standard XML Signature Properties syntax and processing rules and an associated namespace for these properties. The intent is these can be composed with any version of XML Signature using the XML SignatureProperties element.

The group welcomes Last Call comments through 18 March. The group also published several other drafts today: XML Security 1.1 Requirements and Design Considerations, XML Security RELAX NG Schemas, XML Security 2.0 Requirements and Design Considerations, XML Signature Transform Simplification: Requirements and Design, and XML Signature Best Practices. Learn more about XML Technology.

2009-10-22: The XML Security Working Group has published two First Public Working Drafts: XML Signature Syntax and Processing Version 2.0 and Canonical XML Version 2.0. The former provides integrity, message authentication, and/or signer authentication services for data of any type, whether located within the XML that includes the signature or elsewhere. XML Signature 2.0 includes a new transform model designed to address requirements including performance, simplicity and streamability. This model is significantly different than in XML Signature 1.x, see Section 10, Differences from 1.x version. XML Signature 2.0 is designed to be backward compatible, however, enabling the XML Signature 1.x model to be used where necessary. Canonical XML Version 2.0 is a major rewrite of Canonical XML Version 1.1 to address issues around performance, streaming, hardware implementation, robustness, minimizing attack surface, determining what is signed and more. It also incorporates an update to Exclusive Canonicalization, effectively a 2.0 version, as well. (Permalink to news announcement)

2009-07-31: The XML Security Working Group published six documents related to XML signature and encryption. (Permalink to news announcement)

• XML Signature Best Practices. This Working Draft describes best practices related to improving security and mitigating attacks, yet others are for best practices in the practical use of XML Signature, such as signing XML that doesn't use namespaces, for example.
• XML Signature Syntax and Processing Version 1.1. This Working Draft updates the signature specification.
• XML Signature Transform Simplification: Requirements and Design. This Working Draft outlines a proposed simplification of the XML Signature Transform mechanism, intended to enhance security, performance, streamability and to ease adoption.
• W3C XML Encryption Syntax and Processing Version 1.1. This Working Draft updates the encryption specification.
• XML Security Generic Hybrid Ciphers. This First Public Working Draft augments XML Encryption Version 1.1 by defining algorithms, XML types and elements necessary to enable use of generic hybrid ciphers in XML Security applications.
• XML Security Algorithm Cross-Reference. This Group Note collects the various known URIs for XML Security algorithms (at the time of its publication) and indicates which specifications define them.

2009-04-30: The Web Applications Working Group has published the Last Call Working Draft of Widgets 1.0: Digital Signatures. This document defines a profile of the XML Signature Syntax and Processing 1.1 specification to allow a widget package to be digitally signed. Widget authors and distributors can digitally sign widgets as a mechanism to ensure continuity of authorship and distributorship. A user agent can use the digital signature to verify the integrity of the widget package and to confirm the signing key(s). Comments are welcome through 01 June. The Working Group also published an updated Working Draft of Widgets 1.0: Requirements. Learn more about the Rich Web Client Activity. (Permalink to W3 news announcement.)

2009-04-30: The XML Security Working Group has published a Working Draft of XML Signature Properties. This document outlines proposed standard XML Signature Properties syntax and processing rules and an associated namespace for these properties. The intent is these can be composed with any version of XML Signature using the XML SignatureProperties element. Learn more about the Security Activity. (Permalink to W3C news announcement)

2009-02-26: The XML Security Working Group has published a set of eight Working Drafts. The XML Signature 1.1 and XML Encryption 1.1 First Public Working Drafts make changes to the default sets of cryptographic algorithms in both specifications. XML Security Use Cases and Requirements and XML Signature Transform Simplification: Requirements and Design are documents that we expect to help guide the group's work on a future version of the XML Security specifications that might make more radical changes than the 1.1 series of these specifications. The Working Group would like to receive early feedback on these four drafts.

Additionally, the XML Security Derived Keys specification introduces mark-up for key derivation, for use with both XML Signature and XML Encryption. XML Signature Properties defines commonly used signature properties. XML Security Algorithms is a cross-reference for the algorithms and their identifiers used with the XML security specifications, bringing in one place information located in a number of documents. XML Signature Best Practices is a revised Working Draft for Best Practices in using the XML Signature specification. (Permalink)

These Working Drafts are currently open for public comment - to send external comments to the Working Group, please use the mailing list public-xmlsec-comments @ w3.org.

2009-11-18 First Public Working Draft of Best Practices for XML Signature published.

Copyright 2007-2008 W3C (MIT, ERCIM, Keio), All Rights Reserved. W3C liability, trademark, document use and software licensing rules apply. Your interactions with this site are in accordance with our public and Member privacy statements.