XML Signature WG

99-September-30
Chairs: Donald Eastlake and Joseph Reagle
Note Taker: Joseph Reagle [text]

Participants

• Donald Eastlake 3rd, IBM
• Joseph Reagle, W3C
• Mark Bartel, JetForm
• John Boyer, UWI
• David Solo, Citigroup, <david.solo@citicorp.com>
• Barb Fox, Microsoft, bfox@Exchange.Microsoft.com
• Ed Simon , Entrust Technologies Inc.
• [regrets] Todd Vincent, GSU

Minutes

Review of Outstanding Action Items

• ACTION Fox: do we need to add a nonce? Barb still has it on her queue, experts are travelling.
• ACTION Brown: send requirements and syntax comments to list. Sent requirement comments. Still needs to send syntax comments.
• ACTION Reagle: Check with everything capitalized, bounce off Ralph.
• ACTION Reagle: tweak final time and move forward. Will do ASAP.
• ACTION Eastlake: will reword and send to list. Done.

Requirements

xmldsig-requirements-991001.html [candidate InformationalRFC.]

• WG agrees to move it as an ietf-draft and W3C TR, then last call and InfoRFC.

Syntax

• Section 3: Use it as content, try to be consistent throughout.
• Section 4.3: Why is location optional? Should we make the default a reference to the root element minues the signature stuff? Reagle: this makes it impossible for other applications to understand the signature outside of that context. Go with default and put comment of beware of data model.
• Section 4.3.1: Make value a content of element.
• Section 4.3.2: use attribute to find those which might be signature attributes. CDATA, should URI or productions permitted by the MIME/TYPE spec. ACTION Eastlake: propose something. Action Reagle: Make into content.
• Section 4.3.3: add a start to end of bnf, XSLT element. What happens if there is an XSLT in the document, and then the signer puts an XSLT on the document in the manifest. Consistent with the idea that we are not chasing references.
• Section5: do we have types in the reference or in the object? Does the reference point to dsig:object:xml/text or to the type of the target.
  • reflect type="signatureattributes" from Don's proposal.
  • Need to define these clearly.
• Section 7: Reagle will reflect what Mark sent. Solo: we need to define how things of multiple numeric qualities are carried in our context. (Need to do more than just provide a reference, but give a little more specifity.) Don nominates Richard's, ACTION: Bartel will send something by Monday.  Need to define mandatory, recommended. ACTION: Reagle will check the RFC.
• Reagle, will re-insert exclusions and edit such that XSLT/XPath/XPtr is deployed in the spec consistently.
• Eastlake: do a serach for "identity" replace with "minimal."
• Editors/Authors will have a call on Tuesday (1005) and 3PM EST.

Closure on Closure

• Didn't have any time, but see last weeks minutes and email discussion.

Resulting Action Items.

• ACTION Reagle: finish edits to RD and send on its way.
• ACTION Bartel: send AlgID by Monday
• ACTION Eastlake: propose something on URI and MIME types. WG: disucuss..
• ACTION Reagle: check RFC2119 to see if it defines mandatory, recommended, should.
• ACTION Reagle: reflect these minutes in document and post by end of Friday.

• ACTION Fox: do we need to add a nonce? Barb still has it on her queue, experts are travelling.
• ACTION Brown: send requirements and syntax comments to list. Sent requirement comments. Still needs to send syntax comments.
• ACTION Reagle: Check with everything capitalized, bounce off Ralph.