Edit comment LC-2402 for Web Applications Working Group

Quick access to LC-2400 LC-2401 LC-2402

Comment LC-2402

Comment Shortname:

Commenter: Andreas Kuehne <kuehne@trustable.de>

Message-id:

Section of the document concerned:

[Free text description]Document as a wholeDigital Signatures for Widgets Abstract Status of this Document Table of Contents 1. Introduction 1.1. Conventions Used in This Document sample defined term 1.2. Definitions widget package file entry local file header file data data descriptor root of the widget package file name digitally-signed widget package unsigned widget package signature file signature file name widget signature zip relative path 1.3. Versions, Namespaces and Identifiers Widget DigSig URI 1.4. Example 2. Design Goals and Requirements 3. Conformance 4. Signer, Validator, Implementation signer validator implementation 5. Signature Generation signature generation A signer MUST generate a widget signature according to the C... A signer MUST place any generated signature file at the root... A signer MUST apply the Common Constraints for Signature Gen... The signer MUST NOT generate widget signatures using key len... If generating an author signature, the signer MUST include a... A signer MUST ensure that every ds:Reference to same-documen... A signer MUST place a unique identifier string for the signa... 6. Signature Validation signature validation If widget signature validation is successful or fails, the v... To locate the signatures within a widget package, a validato... A validator MUST ignore any file entry whose file name does... A validator MUST validate a widget signature according to Co... A validator MUST verify the Common Constraints for Signature... If a validator finds that a file entry matching the naming c... If a validator finds that a file entry matching the naming c... If a ds:KeyInfo element is present, then a validator MUST ch... A validator MUST support [C14N11] to process a ds:Reference... A validator SHOULD be able to process a ds:Reference to same... 7. Signature Syntax and use in Widget Packages 7.1. Requirements on Widget Signatures When a signer digitally signs a widget package, or a validat... requirements on a widget signature 7.2. Author Signature author signature Author Role Attribute value 7.2.1. Naming Convention for an Author Signature naming convention for an author signature author-sig-filename 7.3. Distributor Signatures distributor signature distributor Distributor Role Attribute value 7.3.1. Naming Convention for a Distributor Signature naming convention for a distributor signature dist-sig-filename 7.4. X.509 Data mandatory certificate format A validator MUST support processing X.509 v3 certificates fo... 7.5. Identifier Signature Property 8. Algorithms An implementation MUST follow the rules specified in [XMLDSI... 8.1. Signature Algorithms signature algorithms recommended key length The following signature algorithms MUST be supported by a va... The following signature algorithms MUST be supported by a si... It is OPTIONAL for a signer to support the following signatu... The following signature algorithm SHOULD be supported by a s... 8.2. Digest Algorithms The following digest algorithms MUST be supported by an impl... digest algorithms SHA-256 8.3. Canonicalization Algorithms The following canonicalization algorithms MUST be supported... canonicalization algorithms 9. Processing Rules 9.1. Locating and Processing Digital Signatures in a Widget Package locate signature files in a widget package An implementation MUST perform a case-sensitive comparisons... Numerical order 9.2. Common Constraints for Signature Generation and Validation common constraints for signature generation and validation When validating a signature, a validator MUST verify each co... When generating a signature, a signer MUST generate the appr... A widget signature MUST have a ds:Reference for every file e... A distributor signature MUST have a ds:Reference for any aut... For references that are not same-document references, the UR... The Algorithm attribute of the ds:digestMethod MUST be one o... A ds:Reference to same-document XML content MUST have a ds:T... An implementation SHOULD be able to process a ds:Reference t... A widget signature MUST include a ds:Object element within t... This ds:Object element MUST contain a single ds:SignaturePro... Each ds:Signature property required by this specification MU... The Algorithm attribute of the ds:CanonicalizationMethod ele... The ds:SignatureMethod algorithm used in the ds:SignatureVal... If one or more certificates are in the ds:KeyInfo element, t... 10. Security Considerations Acknowledgements Normative References [ABNF] [C14N11] [FIPS186-3] [RFC2119] [RFC5280] [UTF-8] [URI] [Widgets Packaging] [XML] [XML-exc-C14N] [XML-Namespaces] [XMLDSIG11] [XMLDSIG-2ndEd] [XMLSecAlgs] [XMLDSIG-Properties] [XML-Schema-Datatypes] [ZIP] Informative References [RFC2560] [Widgets Requirements] [Test-Methodology]
or

Refinement of the section concerned:

Status:

open proposal pending resolved_yes resolved_no resolved_partial other assigned to Nobody

Type: substantive editorial typo question general comment undefined

Resolution status:

Response drafted Resolution implemented Reply sent to commenter

Response status:

No response from Commenter yet Commenter approved disposition Commenter objected to disposition
Commenter's response (URI):

Comment:

Hi all,

just a minor comment found by build a test case :


Section7.1. Common Constraints for Signature Generation and Validation

1. [...]
2. [...]

3. For each ds:Reference element:

1. The URI attribute MUST be a zip relative path from the root of the widget package to the file entry being referenced.



This condition should not be applied to same-document references. It only makes sense to 'external' references.

Greetings

Andreas




--
Andreas Kühne phone: +49 177 293 24 97 mailto: kuehne@trustable.de

Trustable Ltd. Niederlassung Deutschland Ströverstr. 18 - 59427 Unna Amtsgericht Hamm HRB 5868

Directors Andreas Kühne Heiko Veit

Company UK Company No: 5218868 Registered in England and Wales

Related issues: (space separated ids)

WG Notes: During the 6 May 2010 widgets call (http://www.w3.org/2010/05/06-wam-minutes.html#item03), the WG agreed to make an editorial change to address Andreas' comment.

Resolution: The 11-May-2010 LCWD includes an editorial change to address the comment.

(Please make sure the resolution is adapted for public consumption)