RE: Signing just one of the elements in a DOMDocument

> say i want to only sign the body of the second note
element. How do you i
> go about doing this if i use the XPath way how do i
uniquely identify the
> second note's body.

I don't use XPath, so I'm not the one to ask.

The problem you face with it is that the relying party has
to examine the
XPath when he verifies in order to determine what was
signed. Since any
number of expressions will result in the same node set, this
is basically
impossible, so you have to exchange information out of band
about the
expressions to look for, or the RP has to recompute the node
set as part of
verification (or get at the node set produced while using
the signature
verifier).

This is the second most common omission in signature
verification, checking
what was signed. (The most common is relying on KeyInfo as
trusted
information.)

-- Scott

On 8/1/07, Scott Cantor <cantor.2osu.edu> wrote:
>
> This is the second most common omission in signature
verification, checking
> what was signed. (The most common is relying on KeyInfo
as trusted
> information.)
>

I suspect I have asked this question before, but what
exactly is the
problem with relying on the KeyInfo?

If I'm verifying the KeyInfo Certificate versus the
signature:

        KeyInfo ki = signature.getKeyInfo();
        X509Certificate cert = ki.getX509Certificate();

        boolean good = signature.checkSignatureValue(cert);

and verifying that the key is good and is from someone I
trust?  Not
all deployments of signatures are going to use a keyring of
trusted
parties.  In fact any formal use (institutional, enterprise)
of
signatures is virtually guaranteed NOT to.


-- 
- Jason

> If I'm verifying the KeyInfo Certificate versus the
signature:
> 
>         KeyInfo ki = signature.getKeyInfo();
>         X509Certificate cert =
ki.getX509Certificate();
> 
>         boolean good =
signature.checkSignatureValue(cert);
>
> and verifying that the key is good and is from someone
I trust?

Yes, exactly. You don't show that last step in your code,
and the reason is
that it's incredibly complicated. So you shouldn't be
terribly surprised
that people don't understand that step or that they omit
it.

What you're describing is not what I would characterize as
"relying" on
KeyInfo. It's semantics.

> Not all deployments of signatures are going to use a
keyring of trusted
> parties.  In fact any formal use (institutional,
enterprise) of
> signatures is virtually guaranteed NOT to.

Not all deployments can get away with a single static trust
list either, but
that's by far the most common "solution" to the
part of the algorithm you
don't show up above.

-- Scott