Subject: [mile] Comments for draft-ietf-mile-rfc6045-bis-05

From: "Booth, Harold" <[email-masked]>
Date: Fri, 13 Jan 2012 19:22:42 -0500

Hi,

  I was asked to comment on the document draft-ietf-mile-rfc6045-bis-05, specifically looking at its usage of XML Signature Syntax and Processing.  I have a number of specific comments that I have included in the attached pdf. I have used the highlighting and commenting features of Adobe Reader, and hopefully that will work for everyone.

In addition to the specific comments in the attached document I noticed the following:

- The example including the digital signature did not validate for me.  I have attached an example that should validate created using my own tools. I had to place an id on the signature element in order to get the xpath to work.  Please note that the file assumes the schema for iodef-rid is co-located with the file and is named iodef-rid-1.2.xsd.  There are likely some issues with my working example, but I just figured I could provide a working one if needed.

- No mention of what algorithms are required for implementation of xml signing.  The default set of algorithms available in the current version of the recommendation are very limited.  The next version (1.1), which is still a work in progress, is attempting to fix this but is not yet final. The last version I saw was: http://www.w3.org/TR/2011/CR-xmldsig-core1-20110303

- If you want additional algorithms to be used and to be interoperable, RFC4051 should be referenced as well as "XML Encryption Syntax and Processing", http://www.w3.org/TR/xmlenc-core/.  As they both contain additional URIs that should be used to identify the algorithms and methods.

- No mention of "XML Signature Best Practices", http://www.w3.org/TR/xmldsig-bestpractices/ which contains a wealth of information regarding security considerations when using xmldsig.  I would also suggest that based upon these recommendations that you consider what features of xmldsig should be used.  For example XSLT transforms might be restricted or disallowed.

- "XML-Signature XPath Filter 2.0" provides better capabilities for selecting nodes and you may want to consider using that in favor of the 1.0 version.

- This comment is also in the document but in case it gets lost, if the enveloped signature is intended to be placed into the DetachedSignature element you may want to rename it to Signature. If not, guidance should be added on where an enveloped signature should go.

Not really from the document but:
- The file name of the schema I initially received contains a space (which is encoded as %20).  This is somewhat unusual.

Hope this helps.

Regards,

-Harold

---

From: <[email-masked]>
Date: Fri, 13 Jan 2012 20:37:13 -0500

Hi Harold,

Thank you very much for your review and comments!  I was aware that the signature was not working as specified.  I appreciate receiving your signed example as I am having tool issues and was trying to resolve them to properly sign the example (Oxygen digital signatures don't work perfectly).  There may be an opportunity to update the example right after the schema is posted if you can assist (assuming that was the issue with needing the schema being co-located).  I appreciate it!!  

Thank you for the additional reference on specifying algorithms, I will include that in the update.  There was a recent change to prevent the use of SHA-1, so this is helpful.  I will also include the "XML Digital Signature Best Practices" reference.

Using/requiring XPath Filter 2.0 makes sense.  I will make that update.

I'll change the name to Signature, that makes sense, thanks!

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Booth, Harold
Sent: Friday, January 13, 2012 7:23 PM
To: [email-masked]
Subject: [mile] Comments for draft-ietf-mile-rfc6045-bis-05

Hi,

Hope this helps.

Regards,

-Harold

---

From: "Booth, Harold" <[email-masked]>
Date: Fri, 13 Jan 2012 22:41:55 -0500

You're welcome and glad I could help. If you would like to make changes to the example I provided, either before or after you release a final version, I can work with you to get that done.  Changing it up should be relatively quick on my end.

Regards,

-Harold

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, January 13, 2012 8:37 PM
To: Booth, Harold; [email-masked]
Subject: RE: Comments for draft-ietf-mile-rfc6045-bis-05

Hi Harold,

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Booth, Harold
Sent: Friday, January 13, 2012 7:23 PM
To: [email-masked]
Subject: [mile] Comments for draft-ietf-mile-rfc6045-bis-05

Hi,

Hope this helps.

Regards,

-Harold

---

From: <[email-masked]>
Date: Sat, 14 Jan 2012 00:08:49 -0500

Awesome, I was hoping that would be the case since it was that easy with Oxygen (if it really worked)!  I was thinking I needed to increment the schema version since there are some new enumeration values and should probably go to 2.0 for the published version.

Thanks!
Kathleen

-----Original Message-----
From: Booth, Harold [mailto:[email-masked]] 
Sent: Friday, January 13, 2012 10:42 PM
To: Moriarty, Kathleen; [email-masked]
Subject: RE: Comments for draft-ietf-mile-rfc6045-bis-05

Regards,

-Harold

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, January 13, 2012 8:37 PM
To: Booth, Harold; [email-masked]
Subject: RE: Comments for draft-ietf-mile-rfc6045-bis-05

Hi Harold,

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Booth, Harold
Sent: Friday, January 13, 2012 7:23 PM
To: [email-masked]
Subject: [mile] Comments for draft-ietf-mile-rfc6045-bis-05

Hi,

Hope this helps.

Regards,

-Harold