From securityyharris@example.net Sun Aug 01 09:00:25 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 91981 invoked from network); 1 Aug 2004 09:00:25 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 1 Aug 2004 09:00:25 -0000 Received: (qmail 52819 invoked by uid 500); 1 Aug 2004 09:00:24 -0000 Delivered-To: yharris@example.net Received: (qmail 52773 invoked by uid 500); 1 Aug 2004 09:00:23 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 52760 invoked by uid 99); 1 Aug 2004 09:00:23 -0000 X-ASF-Spam-Status: No, hits=1.5 required=10.0 tests=ALL_TRUSTED,INVALID_DATE X-Spam-Check-By: apache.org Date: 01 Aug 04 08:56:09 From: Sam Ruby <yharris@example.net> To: yharris@example.net Subject: [GUMP@brutus]: xml-security/xml-security failed X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N To whom it may engage... This is an automated request, but not an unsolicited one. For more information please visit http://gump.apache.org/nagged.html, and/or contact folk at yharris@example.net. Project xml-security has an issue affecting its community integration. This issue affects 2 projects, and has been outstanding for 7 runs. Project State : 'Failed', Reason 'Build Failed' The following are affected: - wss4j : Web Services Security (WS-Security) Java Implemenatation - xml-security : XML-Signature Syntax and Processing Full details are available at: http://brutus.apache.org/gump/public/xml-security/xml-security/index.html That said, some snippets follow: The following annotations were provided: -DEBUG- Sole jar [xmlsec.jar] identifier set to project name -DEBUG- Dependency on jce exists, no need to add for property lib.jce. -INFO- Enable "verbose" output, due to 7 previous error(s). -INFO- Failed with reason build failed -INFO- Enable "debug" output, due to build failure. The following work was performed: http://brutus.apache.org/gump/public/xml-security/xml-security/gump_work/build_xml-security_xml-security.html Work Name: build_xml-security_xml-security (Type: Build) State: Failed Elapsed: 23 secs Command Line: java -Djava.awt.headless=true -Dbuild.clonevm=true -Xbootclasspath/p:/usr/local/gump/public/workspace/xml-xerces2/java/build/xercesImpl.jar:/usr/local/gump/public/workspace/xml-xerces2/java/build/xml-apis.jar:/usr/local/gump/public/workspace/xml-xalan/java/build/xalan-unbundled.jar:/usr/local/gump/public/workspace/xml-commons/java/external/build/xml-apis.jar org.apache.tools.ant.Main -verbose -Dgump.merge=/usr/local/gump/public/gump/work/merge.xml -Dbuild.sysclasspath=only -Djce.download.sha1=c1f0e975e8c8e0a0105787b249a50615b485d109 -Dlib.jce=/usr/local/gump/packages/jce/jce-jdk13-116.jar -Djce.download.md5=85c64cd754719a4bc8da7e9aa0e113fd gump [Working Directory: /usr/local/gump/public/workspace/xml-security] CLASSPATH : /usr/local/j2sdk1.4.2_04/lib/tools.jar:/usr/local/gump/public/workspace/xml-security/build/classes:/usr/local/gump/public/workspace/xml-security:/usr/local/gump/public/workspace/ant/dist/lib/ant-stylebook.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-swing.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-trax.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-junit.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-nodeps.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant.jar:/usr/local/gump/packages/jce/jce-jdk13-116.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging-api.jar:/usr/local/gump/public/workspace/dist/junit/junit.jar--------------------------------------------- [junit] at java.lang.ClassLoader.loadClass(ClassLoader.java:289) [junit] at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:274) [junit] at java.lang.ClassLoader.loadClass(ClassLoader.java:235) [junit] at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:302) [junit] at java.lang.Class.forName0(Native Method) [junit] at java.lang.Class.forName(Class.java:141) [junit] Test org.apache.xml.security.test.utils.resolver.ResourceResolverSpiTest FAILED Override ignored for property build.test.failed [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.helper.AttrCompareTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.helper.C14nHelperTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.C14NInteropTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.Canonicalizer20010315ExclusiveTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.Canonicalizer20010315Test.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.ExclusiveC14NInterop.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.encryption.BaltimoreEncTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.encryption.XMLCipherTester.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.external.org.apache.xalan.XPathAPI.AttributeAncestorOrSelfTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.external.org.apache.xalan.XPathAPI.XalanBug1425Test.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.interop.BaltimoreTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.interop.IAIKTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.interop.RSASecurityTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.signature.XMLSignatureInputTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.transforms.implementations.TransformBase64DecodeTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.utils.Base64Test.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.utils.resolver.ResourceResolverSpiTest.xml' [junitreport] Using org.apache.xalan.processor Xalan Java 2.6.0 [junitreport] Transform time: 4247ms BUILD FAILED /usr/local/gump/public/workspace/xml-security/build.xml:396: Unit Tests yharris@example.net(Exit.java:139) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:324) at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:95) at org.apache.tools.ant.Task.perform(Task.java:366) at org.apache.tools.ant.Target.execute(Target.java:337) at org.apache.tools.ant.Target.performTasks(Target.java:365) at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1218) at org.apache.tools.ant.Project.executeTarget(Project.java:1188) at org.apache.tools.ant.Project.executeTargets(Project.java:1060) at org.apache.tools.ant.Main.runBuild(Main.java:673) at org.apache.tools.ant.Main.startAnt(Main.java:188) at org.apache.tools.ant.Main.start(Main.java:151) at org.apache.tools.ant.Main.main(Main.java:241) Total time: 22 seconds --------------------------------------------- To subscribe to this information via syndicated feeds: RSS: http://brutus.apache.org/gump/public/xml-security/xml-security/rss.xml Atom: http://brutus.apache.org/gump/public/xml-security/xml-security/atom.xml -- Gump E-mail Identifier (within run) #14. Produced by Gump 2.1.0-alpha-0002. [Run (20040801 00:00:24, brutus:brutus-public:20040801 00:00:24)] http://brutus.apache.org/gump/public/index.html http://brutus.apache.org/gump/public/options.html -- Apache Gump http://gump.apache.org/ [Instance: brutus] From securityyharris@example.net Sun Aug 01 12:39:55 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 63762 invoked from network); 1 Aug 2004 12:39:54 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 1 Aug 2004 12:39:54 -0000 Received: (qmail 69767 invoked by uid 500); 1 Aug 2004 12:39:51 -0000 Delivered-To: yharris@example.net Received: (qmail 69736 invoked by uid 500); 1 Aug 2004 12:39:51 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 69723 invoked by uid 99); 1 Aug 2004 12:39:50 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Sun, 01 Aug 2004 22:39:39 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: XmlDsig error with base64Binary Type References: <yharris@example.net> <yharris@example.net> In-Reply-To: <yharris@example.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Ivan, I've just spent a bit of time playing around with the samples you sent through. Two separate issues : 1. Your IAIK sample uses an XPath-Filter that according to my read should be the same as an enveloping transforms - but for some reason the xsec library is not outputting attributes when canonicalising. This looks like a bug in the library, and would explain why the IAIK sample does not validate. 2. My understanding is that the use of base64binary in a schema will cause a validating parser to callapse any whitespace during validation. So (assuming my understanding is correct) Xerces is stripping new lines (and collapsing spaces) from the base64 data as part of the initial validation. That's why the output signature has no new lines - it's not xsec, it's a natural part of validating a base64binary type element. Cheers, Berin Berin Lautenbach wrote: > Ivan, > > Certainly doesn't sound right! Do you have an example XML file, signed > with IAIK that I can have a look at? > > Cheers, > Berin > > yharris@example.net wrote: > >> >> Hi everybody! >> I'm doing interoperability tests between the IAIK toolkit and >> the Apache XMLDsig C++, but I've found an error that I'd like to >> comment with you cause I'm not really sure it was a bug... >> My scenario is the following: >> I've got a XML file with its schema. What I'm doing >> with both toolkits is to generate a signature from a particular XML >> node with one toolkit and then I try to verify the signature with the >> other one. This was working fine until I introduced the base64Binary >> element into the XML schema. >> What I've realised is that if the XML contains >> a base64 text identified with "xs:string" in the squema, the signature >> can be validated. In other words, both toolkits generates the same >> hash, so it's possible to verify this either with AIAK or XMLDsig >> toolkit. >> >> The problem appears when this element is a "xs:base64Binary" instead >> of "xs:string"; in that case, AIAK toolkits generates the same hash as >> it was a xs:string element ( which I think is correct..), but XMLDsig >> generates a different hash! Is this a bug? Why the hash depends on the >> schema file? >> >> Ah! The hash is different if the base64 text contains carry returns, >> but is correct if the base64 is written in the same line! >> >> Could anybody tell me something about this? I'm using the last >> realease (xml_sec_1.1) for C++. >> Thank you very much in advance! >> >> Ivan >> >> >> >-< >> This email has been digitally signed. You can verify its authenticity >> by installing Safelayer's Root Certificate: >> http://ca.safelayer.com/install_root.html >> >-< >> >> IMPORTANT NOTICE: This communication contains information which is >> confidential and may also be privileged. It is for the exclusive use >> of the intended recipient(s). If you are not the intended recipient(s) >> please note that any form of distribution, copying or use of this >> communication or the information in it is strictly prohibited and may >> be unlawful. If you have received this communication in error please >> return it to the sender. The opinions expressed within this >> communication are not necessarily those expressed by Safelayer Secure >> Communications. > > > From securityyharris@example.net Sun Aug 01 17:21:50 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 12182 invoked from network); 1 Aug 2004 17:21:50 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 1 Aug 2004 17:21:50 -0000 Received: (qmail 89844 invoked by uid 500); 1 Aug 2004 17:21:48 -0000 Delivered-To: yharris@example.net Received: (qmail 89826 invoked by uid 500); 1 Aug 2004 17:21:48 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 89813 invoked by uid 99); 1 Aug 2004 17:21:47 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-Id: <yharris@example.net> From: "Scott Cantor" <yharris@example.net> To: <yharris@example.net> Subject: RE: XmlDsig error with base64Binary Type Date: Sun, 1 Aug 2004 13:21:22 -0400 Organization: The Ohio State University MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Thread-index: AcR3xKUTSeew0RCJSxyKT1whziQAgwAJvE4g In-reply-to: <yharris@example.net> X-CanItPRO-Stream: default X-Spam-Score: undef - spam-scanning disabled X-Scanned-By: CanIt (www . canit . ca) X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N > 2. My understanding is that the use of base64binary in a schema will > cause a validating parser to callapse any whitespace during validation. This is true as long as data type normalization is turned on. Most parsers let you turn it off. This is required to verify signatures over base64 elements when validating. This also sucks, but it's the only workaround if you want to validate. Most people don't, and Xerces itself has so many schema-related bugs going unfixed lately that it's becoming nearly impossible to keep doing it as an implementer. -- Scott From securityyharris@example.net Mon Aug 02 09:50:38 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 65152 invoked from network); 2 Aug 2004 09:50:38 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 2 Aug 2004 09:50:38 -0000 Received: (qmail 35448 invoked by uid 500); 2 Aug 2004 09:50:32 -0000 Delivered-To: yharris@example.net Received: (qmail 35344 invoked by uid 500); 2 Aug 2004 09:50:31 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 35316 invoked by uid 99); 2 Aug 2004 09:50:30 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Mon, 02 Aug 2004 19:50:15 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: XmlDsig error with base64Binary Type References: <yharris@example.net> In-Reply-To: <yharris@example.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Scott Cantor wrote: >>2. My understanding is that the use of base64binary in a schema will >>cause a validating parser to callapse any whitespace during validation. > > > This is true as long as data type normalization is turned on. Most parsers > let you turn it off. This is required to verify signatures over base64 > elements when validating. Or I suppose the other option would be to make sure you validate prior to sign. If I could think of some fancy way to do it, we could even mark base64binary elements somehow and have the security library convert them to normalised form as part of signing. > > This also sucks, but it's the only workaround if you want to validate. Most > people don't, and Xerces itself has so many schema-related bugs going > unfixed lately that it's becoming nearly impossible to keep doing it as an > implementer. :<. Cheers, Berin From securityyharris@example.net Mon Aug 02 11:51:20 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 43256 invoked from network); 2 Aug 2004 11:51:20 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 2 Aug 2004 11:51:20 -0000 Received: (qmail 63764 invoked by uid 500); 2 Aug 2004 11:51:18 -0000 Delivered-To: yharris@example.net Received: (qmail 63592 invoked by uid 500); 2 Aug 2004 11:51:17 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 63579 invoked by uid 99); 2 Aug 2004 11:51:17 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Mon, 02 Aug 2004 21:51:02 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: XSL transform in C++ References: <yharris@example.net> In-Reply-To: <yharris@example.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Ian, Many thanks for that. I've just checked in a slight variation to your patch. We need to have the local name used as the key, because the spec requires we do a secondary sort of attributes on local names. So I still call getNodeName, but I then do a quick check for ':' to find the local part. Thanks! Cheers, Berin Ian Alderman wrote: > The attached diff makes the problem go away for my code and illustrates > what's happening. In line 1122 of XSECC14n20010315.cpp, m_formatBuffer > becomes zero length, so every attribute gets added to the sort list with > the same key, meaning that all attributes except the first in an element get > discarded in canonicalization. > > See http://xml.apache.org/xerces-c/apiDocs/classDOMNode.html#z231_4 > Perhaps this is why getLocalName is returning null? Maybe the code should > test, and use getNodeName if getLocaName returns null. > > Hope this helps, > > -Ian > > On Mon, 19 Jul 2004, Ian Alderman wrote: > > >>I was able to make some progress on debugging this. >> >>Debugging by printing the SignedInfo bytes as they get hashed (in >>TXFMSHA1.cpp), I was able to determine that these bytes are different >>when they get signed than they are when they get verified (and so the >>hash is also different). Specifically, if I use the following >>stylesheet, some of the "select" attributes (which happen to be second >>attributes) get discarded. >> >>My stylesheet and code are here: >>http://www.cs.wisc.edu/~alderman/xsec/ >> >>-Ian >> >> >>>It would appear that the transform is being applied correctly; the >>>digest is the same as is produced by the Java library, but the >>>signature is different (the Java library signature verifies). >> >> >>------------------------------------------------------------------------ >> >>85 ferdinand ~/workspace/xml/src/xml-security/xml-security/c/src > cvs diff canon >>? canon/Makefile >>? canon/Makefile.in >>? canon/XSECC14n20010315.cpp.ORIG >>cvs server: Diffing canon >>Index: canon/XSECC14n20010315.cpp >>=================================================================== >>RCS file: /home/cvspublic/xml-security/c/src/canon/XSECC14n20010315.cpp,v >>retrieving revision 1.15 >>diff -r1.15 XSECC14n20010315.cpp >>1122c1122 >>< m_formatBuffer << (*mp_formatter << tmpAtts->item(i)->getLocalName()); >>--- >> >>> m_formatBuffer << (*mp_formatter << tmpAtts->item(i)->getNodeName()); >> >> From securityyharris@example.net Mon Aug 02 12:51:24 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 74823 invoked from network); 2 Aug 2004 12:51:24 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 2 Aug 2004 12:51:24 -0000 Received: (qmail 46435 invoked by uid 500); 2 Aug 2004 12:51:20 -0000 Delivered-To: yharris@example.net Received: (qmail 46418 invoked by uid 500); 2 Aug 2004 12:51:20 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 46404 invoked by uid 99); 2 Aug 2004 12:51:20 -0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> From: "Schneider, Nils" <yharris@example.net> To: "'yharris@example.net'" <yharris@example.net> Subject: unsubsribe Date: Mon, 2 Aug 2004 14:51:06 +0200 MIME-Version: 1.0 Content-Type: text/plain X-SA-Exim-Mail-From: yharris@example.net X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N -------------------------------------------------------------------------------- The information contained herein is confidential and is intended solely for the addressee. Access by any other party is unauthorised without the express written permission of the sender. If you are not the intended recipient, please contact the sender either via the company switchboard on 734.350.6962, or via e-mail return. If you have received this e-mail in error or wish to read our e-mail disclaimer statement and monitoring policy, please refer to http://www.drkw.com/disc/email/ or contact the sender. 3166 -------------------------------------------------------------------------------- From securityyharris@example.net Mon Aug 02 14:13:12 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 36346 invoked from network); 2 Aug 2004 14:13:11 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 2 Aug 2004 14:13:11 -0000 Received: (qmail 33625 invoked by uid 500); 2 Aug 2004 14:13:01 -0000 Delivered-To: yharris@example.net Received: (qmail 33546 invoked by uid 500); 2 Aug 2004 14:13:00 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 33478 invoked by uid 99); 2 Aug 2004 14:12:59 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-Id: <yharris@example.net> From: "Scott Cantor" <yharris@example.net> To: <yharris@example.net> Subject: RE: XmlDsig error with base64Binary Type Date: Mon, 2 Aug 2004 10:12:43 -0400 Organization: The Ohio State University MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 In-reply-to: <yharris@example.net> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Thread-index: AcR4dilxBaCRDCv/SoGkbg6MQZWdNAAJHCUg X-CanItPRO-Stream: default X-Spam-Score: undef - spam-scanning disabled X-Scanned-By: CanIt (www . canit . ca) X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N > Or I suppose the other option would be to make sure you validate prior > to sign. If I could think of some fancy way to do it, we could even > mark base64binary elements somehow and have the security library convert > them to normalised form as part of signing. You mean verify first and then validate? You can, but until recently it required two parse operations, which isn't reasonable. I don't know if Xerces-C supports in-memory validation of a DOM yet. The Java code does. -- Scott From securityyharris@example.net Tue Aug 03 05:56:10 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 39441 invoked from network); 3 Aug 2004 05:56:10 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 05:56:10 -0000 Received: (qmail 87146 invoked by uid 500); 3 Aug 2004 05:56:08 -0000 Delivered-To: yharris@example.net Received: (qmail 87022 invoked by uid 500); 3 Aug 2004 05:56:07 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 87008 invoked by uid 99); 3 Aug 2004 05:56:06 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests=SPF_HELO_FAIL X-Spam-Check-By: apache.org From: "Milan Tomic" <yharris@example.net> To: <yharris@example.net> Subject: RE: Encrypting with multiple public keys Date: Tue, 3 Aug 2004 07:55:46 +0200 Message-ID: <003f01c4791e$88a2b1c0$ce018ac1@Majestix> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0040_01C4792F.4C2B81C0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 In-Reply-To: <yharris@example.net> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Importance: Normal X-Virus-Scanned: by yharris@example.net X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N This is a multi-part message in MIME format. ------=_NextPart_000_0040_01C4792F.4C2B81C0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Berin, I've found something strange. When I encrypt some node with multiple keys, error occures during decryption if my private key is not first key listed under <KeyInfo>. I'm attaching two XML documents. Sample_OK.xml file have my key listed in the first place, and someone's key in the second place and decryption works fine. Sample_BAD.xml have someone's key in the first place and mine key in the second place and decryption fails. Am I doing something wrong or XSEC is trying to decrypt only first key using given private key, instead of trying to decrypt all keys? Thank you, Milan ------=_NextPart_000_0040_01C4792F.4C2B81C0 Content-Type: text/xml; name="sample_OK.xml" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="sample_OK.xml" <?xml version=3D"1.0" encoding=3D"UTF-8" standalone=3D"no" ?><note> <to><xenc:EncryptedData = xmlns:xenc=3D"http://www.w3.org/2001/04/xmlenc#" = Type=3D"http://www.w3.org/2001/04/xmlenc#Element"> <xenc:EncryptionMethod = Algorithm=3D"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/> <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedKey Recipient=3D"Milan Tomic" = xmlns:xenc=3D"http://www.w3.org/2001/04/xmlenc#"> <xenc:EncryptionMethod = Algorithm=3D"http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> <ds:KeyName>Im9kmELIcA9zx89O9xJZ/3LM1nk=3D</ds:KeyName> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>wraep/SrhWkCuTTGrGUVADJZv90mcbmJEr6zfxk0fK0Ld529P2ZNY12= edvGVzds1ggffMiejo4bK sm9jY21/HeZQs2EAR1aoAl5tiH+1OFl6AiEAWxdGjYZhFeu6Il2R3e0iG9zvCYc1aHawoY3aZ= Q3g oodP+h+/XxxqrYwHQ3g=3D</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> <xenc:EncryptedKey Recipient=3D"Someone else" = xmlns:xenc=3D"http://www.w3.org/2001/04/xmlenc#"> <xenc:EncryptionMethod = Algorithm=3D"http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> <ds:KeyName>Bk0cBvyFUVsVKHynbbBI9YnqZHQ=3D</ds:KeyName> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>+CmPdrjRMwQPVwZ08hEe4QCufFh9tFtIsWgwnJOW7f1zKC889SSPqvc= H01GNPeI06U79E5+BKPmY iFeyz5pl2fboYYfd2qnu+rpSIgRyut4gLAFmlfOVT88pftBupOpFarsBfbLbuMypjaxDIPO5K= HOG Nnx1tX9WLbjw19OvdCI=3D</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>p3/EaWuoTrmUBcrCBNt0Gxd/WbqowwkEV2Cte8y7I3o74z+x15fxXQ=3D= =3D</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData></to> <from>Jani</from> <heading>Reminder</heading> <body>Blah Blah Blah</body> </note> ------=_NextPart_000_0040_01C4792F.4C2B81C0 Content-Type: text/xml; name="sample_BAD.xml" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="sample_BAD.xml" <?xml version=3D"1.0" encoding=3D"UTF-8" standalone=3D"no" ?><note> <to><xenc:EncryptedData = xmlns:xenc=3D"http://www.w3.org/2001/04/xmlenc#" = Type=3D"http://www.w3.org/2001/04/xmlenc#Element"> <xenc:EncryptionMethod = Algorithm=3D"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/> <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedKey Recipient=3D"Someone else" = xmlns:xenc=3D"http://www.w3.org/2001/04/xmlenc#"> <xenc:EncryptionMethod = Algorithm=3D"http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> <ds:KeyName>Bk0cBvyFUVsVKHynbbBI9YnqZHQ=3D</ds:KeyName> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>+CmPdrjRMwQPVwZ08hEe4QCufFh9tFtIsWgwnJOW7f1zKC889SSPqvc= H01GNPeI06U79E5+BKPmY iFeyz5pl2fboYYfd2qnu+rpSIgRyut4gLAFmlfOVT88pftBupOpFarsBfbLbuMypjaxDIPO5K= HOG Nnx1tX9WLbjw19OvdCI=3D</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> <xenc:EncryptedKey Recipient=3D"Milan Tomic" = xmlns:xenc=3D"http://www.w3.org/2001/04/xmlenc#"> <xenc:EncryptionMethod = Algorithm=3D"http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> <ds:KeyName>Im9kmELIcA9zx89O9xJZ/3LM1nk=3D</ds:KeyName> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>wraep/SrhWkCuTTGrGUVADJZv90mcbmJEr6zfxk0fK0Ld529P2ZNY12= edvGVzds1ggffMiejo4bK sm9jY21/HeZQs2EAR1aoAl5tiH+1OFl6AiEAWxdGjYZhFeu6Il2R3e0iG9zvCYc1aHawoY3aZ= Q3g oodP+h+/XxxqrYwHQ3g=3D</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>p3/EaWuoTrmUBcrCBNt0Gxd/WbqowwkEV2Cte8y7I3o74z+x15fxXQ=3D= =3D</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData></to> <from>Jani</from> <heading>Reminder</heading> <body>Blah Blah Blah</body> </note> ------=_NextPart_000_0040_01C4792F.4C2B81C0-- From securityyharris@example.net Tue Aug 03 11:03:13 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 53020 invoked from network); 3 Aug 2004 11:03:13 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 11:03:13 -0000 Received: (qmail 68159 invoked by uid 500); 3 Aug 2004 11:03:09 -0000 Delivered-To: yharris@example.net Received: (qmail 68124 invoked by uid 500); 3 Aug 2004 11:03:08 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 68109 invoked by uid 99); 3 Aug 2004 11:03:08 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Tue, 03 Aug 2004 21:02:54 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: Encrypting with multiple public keys References: <003f01c4791e$88a2b1c0$ce018ac1@Majestix> In-Reply-To: <003f01c4791e$88a2b1c0$ce018ac1@Majestix> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Milan, Is an exception being thrown at all? I had a quick check of the code, and theoretically it should be looping through all the key infos until a decrypt succeeds. Unfortunately it looks like it won't handle an exception cleanly (this is probably one of those cases where they should be quietly ignored), so that may be what is causing the problem. Cheers, Berin Milan Tomic wrote: > Berin, > > I've found something strange. When I encrypt some node with > multiple keys, error occures during decryption if my private key is not > first key listed under <KeyInfo>. I'm attaching two XML documents. > Sample_OK.xml file have my key listed in the first place, and someone's > key in the second place and decryption works fine. Sample_BAD.xml have > someone's key in the first place and mine key in the second place and > decryption fails. Am I doing something wrong or XSEC is trying to > decrypt only first key using given private key, instead of trying to > decrypt all keys? > > Thank you, > Milan > > > ------------------------------------------------------------------------ > > <?xml version="1.0" encoding="UTF-8" standalone="no" ?><note> > <to><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"> > <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> > <xenc:EncryptedKey Recipient="Milan Tomic" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"> > <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> > <ds:KeyName>Im9kmELIcA9zx89O9xJZ/3LM1nk=</ds:KeyName> > </ds:KeyInfo> > <xenc:CipherData> > <xenc:CipherValue>wraep/SrhWkCuTTGrGUVADJZv90mcbmJEr6zfxk0fK0Ld529P2ZNY12edvGVzds1ggffMiejo4bK > sm9jY21/HeZQs2EAR1aoAl5tiH+1OFl6AiEAWxdGjYZhFeu6Il2R3e0iG9zvCYc1aHawoY3aZQ3g > oodP+h+/XxxqrYwHQ3g=</xenc:CipherValue> > </xenc:CipherData> > </xenc:EncryptedKey> > <xenc:EncryptedKey Recipient="Someone else" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"> > <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> > <ds:KeyName>Bk0cBvyFUVsVKHynbbBI9YnqZHQ=</ds:KeyName> > </ds:KeyInfo> > <xenc:CipherData> > <xenc:CipherValue>+CmPdrjRMwQPVwZ08hEe4QCufFh9tFtIsWgwnJOW7f1zKC889SSPqvcH01GNPeI06U79E5+BKPmY > iFeyz5pl2fboYYfd2qnu+rpSIgRyut4gLAFmlfOVT88pftBupOpFarsBfbLbuMypjaxDIPO5KHOG > Nnx1tX9WLbjw19OvdCI=</xenc:CipherValue> > </xenc:CipherData> > </xenc:EncryptedKey> > </ds:KeyInfo> > <xenc:CipherData> > <xenc:CipherValue>p3/EaWuoTrmUBcrCBNt0Gxd/WbqowwkEV2Cte8y7I3o74z+x15fxXQ==</xenc:CipherValue> > </xenc:CipherData> > </xenc:EncryptedData></to> > <from>Jani</from> > <heading>Reminder</heading> > <body>Blah Blah Blah</body> > </note> > > > ------------------------------------------------------------------------ > > <?xml version="1.0" encoding="UTF-8" standalone="no" ?><note> > <to><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"> > <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> > <xenc:EncryptedKey Recipient="Someone else" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"> > <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> > <ds:KeyName>Bk0cBvyFUVsVKHynbbBI9YnqZHQ=</ds:KeyName> > </ds:KeyInfo> > <xenc:CipherData> > <xenc:CipherValue>+CmPdrjRMwQPVwZ08hEe4QCufFh9tFtIsWgwnJOW7f1zKC889SSPqvcH01GNPeI06U79E5+BKPmY > iFeyz5pl2fboYYfd2qnu+rpSIgRyut4gLAFmlfOVT88pftBupOpFarsBfbLbuMypjaxDIPO5KHOG > Nnx1tX9WLbjw19OvdCI=</xenc:CipherValue> > </xenc:CipherData> > </xenc:EncryptedKey> > <xenc:EncryptedKey Recipient="Milan Tomic" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"> > <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> > <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> > <ds:KeyName>Im9kmELIcA9zx89O9xJZ/3LM1nk=</ds:KeyName> > </ds:KeyInfo> > <xenc:CipherData> > <xenc:CipherValue>wraep/SrhWkCuTTGrGUVADJZv90mcbmJEr6zfxk0fK0Ld529P2ZNY12edvGVzds1ggffMiejo4bK > sm9jY21/HeZQs2EAR1aoAl5tiH+1OFl6AiEAWxdGjYZhFeu6Il2R3e0iG9zvCYc1aHawoY3aZQ3g > oodP+h+/XxxqrYwHQ3g=</xenc:CipherValue> > </xenc:CipherData> > </xenc:EncryptedKey> > </ds:KeyInfo> > <xenc:CipherData> > <xenc:CipherValue>p3/EaWuoTrmUBcrCBNt0Gxd/WbqowwkEV2Cte8y7I3o74z+x15fxXQ==</xenc:CipherValue> > </xenc:CipherData> > </xenc:EncryptedData></to> > <from>Jani</from> > <heading>Reminder</heading> > <body>Blah Blah Blah</body> > </note> From securityyharris@example.net Tue Aug 03 11:07:44 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 57279 invoked from network); 3 Aug 2004 11:07:44 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 11:07:44 -0000 Received: (qmail 73319 invoked by uid 500); 3 Aug 2004 11:07:43 -0000 Delivered-To: yharris@example.net Received: (qmail 72967 invoked by uid 500); 3 Aug 2004 11:07:42 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 72954 invoked by uid 99); 3 Aug 2004 11:07:42 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Tue, 03 Aug 2004 21:07:34 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: XmlDsig error with base64Binary Type References: <yharris@example.net> <yharris@example.net> <yharris@example.net> In-Reply-To: <yharris@example.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Ivan, > 1. Your IAIK sample uses an XPath-Filter that according to my read > should be the same as an enveloping transforms - but for some reason the > xsec library is not outputting attributes when canonicalising. This > looks like a bug in the library, and would explain why the IAIK sample > does not validate. There *was* a bug in the library. There was a case where attribute nodes would get dropped from the input nodeset that is passed to the xpath-filter transform. I've checked a fix into CVS and the CVS code now validates the IAIK sample as OK. Cheers, Berin From securityyharris@example.net Tue Aug 03 11:15:00 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 62064 invoked from network); 3 Aug 2004 11:15:00 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 11:15:00 -0000 Received: (qmail 81731 invoked by uid 500); 3 Aug 2004 11:14:56 -0000 Delivered-To: yharris@example.net Received: (qmail 81641 invoked by uid 500); 3 Aug 2004 11:14:55 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 81628 invoked by uid 99); 3 Aug 2004 11:14:55 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Tue, 03 Aug 2004 21:14:52 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: XmlDsig error with base64Binary Type References: <yharris@example.net> In-Reply-To: <yharris@example.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Scott Cantor wrote: >>Or I suppose the other option would be to make sure you validate prior >>to sign. If I could think of some fancy way to do it, we could even >>mark base64binary elements somehow and have the security library convert >>them to normalised form as part of signing. > > > You mean verify first and then validate? You can, but until recently it > required two parse operations, which isn't reasonable. I don't know if > Xerces-C supports in-memory validation of a DOM yet. The Java code does. I was actually thinking more about always making sure the original document is validated prior to signing, just to make sure you are signing the normalised form. But that's going to be unworkable in many instances - particularly if you are building the DOM in memory. It was just idle musings :>. I had a quick look at validating in memory with Xerces-C a few months back and couldn't find anything, but then I wasn't looking too hard. CHeers, Berin From securityyharris@example.net Tue Aug 03 11:27:01 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 68673 invoked from network); 3 Aug 2004 11:27:01 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 11:27:01 -0000 Received: (qmail 93448 invoked by uid 500); 3 Aug 2004 11:26:58 -0000 Delivered-To: yharris@example.net Received: (qmail 93420 invoked by uid 500); 3 Aug 2004 11:26:58 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 93407 invoked by uid 99); 3 Aug 2004 11:26:57 -0000 X-ASF-Spam-Status: No, hits=1.0 required=10.0 tests=FORGED_RCVD_HELO,HTML_30_40,HTML_MESSAGE,NO_REAL_NAME X-Spam-Check-By: apache.org In-Reply-To: <yharris@example.net> To: yharris@example.net Subject: Re: XmlDsig error with base64Binary Type MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.0 September 26, 2002 Message-ID: <yharris@example.net> From: yharris@example.net Date: Tue, 3 Aug 2004 13:28:51 +0200 X-MIMETrack: S/MIME Sign by Notes Client on Ivan Fontanals/SFLY(Release 6.0|September 26, 2002) at 03/08/2004 13:23:25, Serialize by Notes Client on Ivan Fontanals/SFLY(Release 6.0|September 26, 2002) at 03/08/2004 13:23:25, Serialize complete at 03/08/2004 13:23:25, Itemize by Notes Client on Ivan Fontanals/SFLY(Release 6.0|September 26, 2002) at 03/08/2004 13:23:26, S/MIME Sign complete at 03/08/2004 13:23:26, Serialize by Router on Bcn/SFLY(Release 5.0.12 |February 13, 2003) at 03/08/2004 13:28:52, Serialize complete at 03/08/2004 13:28:52 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary=-------z11711_boundary_sign X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N This is an S/MIME signed message. ---------z11711_boundary_sign Content-Type: multipart/alternative; boundary="=_alternative 003E91DEC1256EE5_=" This is a multipart message in MIME format. --=_alternative 003E91DEC1256EE5_= Content-Type: text/plain; charset="US-ASCII" Hi Berin, well, first of all I would like to thanks you for all the work and tests done! I 'll ckeck the new CVS version, but I have a last question: With this solved bug, will be possible now to validate a XML signed with XSEC against IAIK toolkit ? I mean if the returned Xsec hash will be the same in both toolkits when exists the base64Binary type in the schema.... Again, thank you very much! Cheers, Ivan >-< This email has been digitally signed. You can verify its authenticity by installing Safelayer's Root Certificate: http://ca.safelayer.com/install_root.html >-< IMPORTANT NOTICE: This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s) please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you have received this communication in error please return it to the sender. The opinions expressed within this communication are not necessarily those expressed by Safelayer Secure Communications. Berin Lautenbach <yharris@example.net> 03/08/2004 13:07 Please respond to security-dev To: yharris@example.net cc: Subject: Re: XmlDsig error with base64Binary Type Ivan, > 1. Your IAIK sample uses an XPath-Filter that according to my read > should be the same as an enveloping transforms - but for some reason the > xsec library is not outputting attributes when canonicalising. This > looks like a bug in the library, and would explain why the IAIK sample > does not validate. There *was* a bug in the library. There was a case where attribute nodes would get dropped from the input nodeset that is passed to the xpath-filter transform. I've checked a fix into CVS and the CVS code now validates the IAIK sample as OK. Cheers, Berin --=_alternative 003E91DEC1256EE5_= Content-Type: text/html; charset="US-ASCII" <br><font size=2 face="sans-serif">Hi Berin,</font> <br><font size=2 face="sans-serif">&nbsp; &nbsp; &nbsp; &nbsp; well, first of all I would like to thanks you for all the work and tests done! </font> <br> <br><font size=2 face="sans-serif">I 'll ckeck the new CVS version, but I have a last question: With this solved bug, will be possible now to validate a XML signed with &nbsp;XSEC against IAIK toolkit ? </font> <br><font size=2 face="sans-serif">&nbsp; &nbsp; &nbsp; &nbsp; I mean if &nbsp;the returned Xsec hash will be the same in both toolkits when exists the base64Binary type in the schema....</font> <br> <br><font size=2 face="sans-serif">Again, &nbsp; &nbsp; &nbsp; &nbsp; thank you very much!</font> <br> <br><font size=2><tt>Cheers,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Ivan</tt></font> <br><font size=2 face="sans-serif">&gt;-&lt;<br> This email has been digitally signed. You can verify its authenticity &nbsp;by installing Safelayer's Root Certificate:<br> http://ca.safelayer.com/install_root.html<br> &gt;-&lt;<br> <br> IMPORTANT NOTICE: This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s) please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you have received this communication in error please return it to the sender. The opinions expressed within this communication are not necessarily those expressed by Safelayer Secure Communications.</font> <br> <br> <br> <table width=100%> <tr valign=top> <td> <td><font size=1 face="sans-serif"><b>Berin Lautenbach &lt;yharris@example.net&gt;</b></font> <p><font size=1 face="sans-serif">03/08/2004 13:07</font> <br><font size=1 face="sans-serif">Please respond to security-dev</font> <td><font size=1 face="Arial">&nbsp; &nbsp; &nbsp; &nbsp; </font> <br><font size=1 face="sans-serif">&nbsp; &nbsp; &nbsp; &nbsp; To: &nbsp; &nbsp; &nbsp; &nbsp;yharris@example.net</font> <br><font size=1 face="sans-serif">&nbsp; &nbsp; &nbsp; &nbsp; cc: &nbsp; &nbsp; &nbsp; &nbsp;</font> <br><font size=1 face="sans-serif">&nbsp; &nbsp; &nbsp; &nbsp; Subject: &nbsp; &nbsp; &nbsp; &nbsp;Re: XmlDsig error with base64Binary Type</font></table> <br> <br> <br><font size=2><tt>Ivan,<br> <br> &gt; 1. &nbsp;Your IAIK sample uses an XPath-Filter that according to my read <br> &gt; should be the same as an enveloping transforms - but for some reason the <br> &gt; xsec library is not outputting attributes when canonicalising. &nbsp;This <br> &gt; looks like a bug in the library, and would explain why the IAIK sample <br> &gt; does not validate.<br> <br> There *was* a bug in the library. &nbsp;There was a case where attribute <br> nodes would get dropped from the input nodeset that is passed to the <br> xpath-filter transform. &nbsp;I've checked a fix into CVS and the CVS code <br> now validates the IAIK sample as OK.<br> <br> Cheers,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Berin<br> <br> </tt></font> <br> --=_alternative 003E91DEC1256EE5_=-- ---------z11711_boundary_sign Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIIcKwIBATELMAkGBSsOAwIaBQAwCwYJKoZIhvcNAQcBoIIaODCCA5Iw ggJ6oAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwaTFBMD8GA1UEChM4U2FmZWxheWVyIFNlY3VyZSBD b21tdW5pY2F0aW9ucywgUy5BLiBbQy5JLkYuIEE2MTkzMDA0Nl0xJDAiBgNVBAMTG1NhZmVsYXll ciAtIENsYXNzIDEgUm9vdCBDQTAeFw0wMjAyMTIyMzAwMDBaFw0yMjAzMTIyMzAwMDBaMGkxQTA/ BgNVBAoTOFNhZmVsYXllciBTZWN1cmUgQ29tbXVuaWNhdGlvbnMsIFMuQS4gW0MuSS5GLiBBNjE5 MzAwNDZdMSQwIgYDVQQDExtTYWZlbGF5ZXIgLSBDbGFzcyAxIFJvb3QgQ0EwggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDg/UoUfnaaLUKiqD+iCtrARHcx3VrH1P7sONxNxsqJKSOI38Qm nyoGK4VzejuR5fG4WNTPxH3XjhZpJa2317cLE5MAst2HloEDTzAXbQeg2H303da1PK8Yl682J4LY C87/kClWM2Tfmfl/VkROu8ESdgsrLiOLwQIKOXYFLOlss1otWqWpcIsx1N4fCo5fF1NK3GXwga4+ YSd+ATjy36RFihqgaUgJgmQSwpvDfmmWs/ZuQqj6RlVPY4rNgBZuOj8s5ZhXDgROx+Z3t1rCLjVx 0nM6EX9tDHNIxz/Qks5tZaGTbsIzBEdNerDUDGmhQ1r3QJ/8zzT5RtK9eO3UtK1nAgMBAAGjRTBD MBIGA1UdEwEB/wQIMAYBAf8CAQIwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRGh8tExvshmKxE xarjeZ9ONEfAujANBgkqhkiG9w0BAQUFAAOCAQEACWsMSu9eBEc/DacNlTABwSgIpFodnr/8ud/k nEU+6tBHhtbZ1qQGIQmcdnBnihEe6CHRqQ1PjFKvsQsELLj5AF7Ficj+v/Y3iF4i6oHQJfe7lvst Ecn8rlY3mAaXF6t1Kl+mw/Hf2Ww5zYdOuGvA2DjNqbx90MJqZy0+yMmf+pPQzTPp8BzAIkWMYVEr OmyIcoQjZ7yV15hVuvxi/Zhqvb7msk71FLe9hn9rVSuRlOf9ynLH7tLMk2POuXL2bqvBirwNHuT+ p0iOBZ7jJ988kXEK5e63O1rmfgisd1bNNRiIZyCExwI2do5tI2y/pDYjWQBJ/G2OQ1ljvBQ5vOR4 gDCCA5IwggJ6oAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwaTFBMD8GA1UEChM4U2FmZWxheWVyIFNl Y3VyZSBDb21tdW5pY2F0aW9ucywgUy5BLiBbQy5JLkYuIEE2MTkzMDA0Nl0xJDAiBgNVBAMTG1Nh ZmVsYXllciAtIENsYXNzIDEgUm9vdCBDQTAeFw0wMjAyMTIyMzAwMDBaFw0yMjAzMTIyMzAwMDBa MGkxQTA/BgNVBAoTOFNhZmVsYXllciBTZWN1cmUgQ29tbXVuaWNhdGlvbnMsIFMuQS4gW0MuSS5G LiBBNjE5MzAwNDZdMSQwIgYDVQQDExtTYWZlbGF5ZXIgLSBDbGFzcyAxIFJvb3QgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDg/UoUfnaaLUKiqD+iCtrARHcx3VrH1P7sONxNxsqJ KSOI38QmnyoGK4VzejuR5fG4WNTPxH3XjhZpJa2317cLE5MAst2HloEDTzAXbQeg2H303da1PK8Y l682J4LYC87/kClWM2Tfmfl/VkROu8ESdgsrLiOLwQIKOXYFLOlss1otWqWpcIsx1N4fCo5fF1NK 3GXwga4+YSd+ATjy36RFihqgaUgJgmQSwpvDfmmWs/ZuQqj6RlVPY4rNgBZuOj8s5ZhXDgROx+Z3 t1rCLjVx0nM6EX9tDHNIxz/Qks5tZaGTbsIzBEdNerDUDGmhQ1r3QJ/8zzT5RtK9eO3UtK1nAgMB AAGjRTBDMBIGA1UdEwEB/wQIMAYBAf8CAQIwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRGh8tE xvshmKxExarjeZ9ONEfAujANBgkqhkiG9w0BAQUFAAOCAQEACWsMSu9eBEc/DacNlTABwSgIpFod nr/8ud/knEU+6tBHhtbZ1qQGIQmcdnBnihEe6CHRqQ1PjFKvsQsELLj5AF7Ficj+v/Y3iF4i6oHQ Jfe7lvstEcn8rlY3mAaXF6t1Kl+mw/Hf2Ww5zYdOuGvA2DjNqbx90MJqZy0+yMmf+pPQzTPp8BzA IkWMYVErOmyIcoQjZ7yV15hVuvxi/Zhqvb7msk71FLe9hn9rVSuRlOf9ynLH7tLMk2POuXL2bqvB irwNHuT+p0iOBZ7jJ988kXEK5e63O1rmfgisd1bNNRiIZyCExwI2do5tI2y/pDYjWQBJ/G2OQ1lj vBQ5vOR4gDCCBKAwggOIoAMCAQICECB/rlBHxmIeQFcwvy2yiJ0wDQYJKoZIhvcNAQEFBQAwbjFB MD8GA1UEChM4U2FmZWxheWVyIFNlY3VyZSBDb21tdW5pY2F0aW9ucywgUy5BLiBbQy5JLkYuIEE2 MTkzMDA0Nl0xKTAnBgNVBAMTIFNhZmVsYXllciAtIENsYXNzIDEgQ29ycG9yYXRlIENBMB4XDTA0 MDMxNjE2NTIxNVoXDTA1MDMxNjE2NTIxNVowfTELMAkGA1UEBhMCRVMxEjAQBgNVBAoTCVNhZmVs YXllcjEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxFzAVBgNVBAMTDkl2YW4gRm9udGFuYWxzMSswKQYJ KoZIhvcNAQkBFhxpdmFuLmZvbnRhbmFsc0BzYWZlbGF5ZXIuY29tMIGfMA0GCSqGSIb3DQEBAQUA A4GNADCBiQKBgQCsrYL/MCXAZQQTIUWfCEpREE1lCLLPXB9QVgjMhbDMG9Y7teDk72WVqJrAy9p1 jJtb3YvXgEVHbW1HUFqp19fk1De77ZhKlBxRnU3h6SHoc32ORRFQk5b5JZMUGXfkRQoh4fEzkNxI kRCai7y5MGOOE2qyPhyf4jAL16zWtDlnVwIDAQABo4IBrTCCAakwDAYDVR0TAQH/BAIwADAOBgNV HQ8BAf8EBAMCA/gwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGCWCGSAGG+EIBAQQE AwIFoDAdBgNVHQ4EFgQU5PuKUDNocc0SoG6EEo53zOge4BAwgZMGA1UdIwSBizCBiIAUNNuSq/BP y9wTvWipXxvAGMd9ddahbaRrMGkxQTA/BgNVBAoTOFNhZmVsYXllciBTZWN1cmUgQ29tbXVuaWNh dGlvbnMsIFMuQS4gW0MuSS5GLiBBNjE5MzAwNDZdMSQwIgYDVQQDExtTYWZlbGF5ZXIgLSBDbGFz cyAxIFJvb3QgQ0GCAQwwXAYDVR0gBFUwUzBRBgsrBgEEAaRmAwECATBCMEAGCCsGAQUFBwIBFjRo dHRwOi8vY2Euc2FmZWxheWVyLmNvbS9wb2xpY3kvc2FmZWxheWVyX3BvbGljeS5odG1sMEQGA1Ud HwQ9MDswOaA3oDWGM2h0dHA6Ly9jYS5zYWZlbGF5ZXIuY29tL2NybC9zYWZlbGF5ZXJfY29ycG9y YXRlLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAlgTfNiGJA4FFqcnka5FfuH3O7+Ar8yGSoqe4OhUB iyzzVK26Apd1O2usLYPQIS6S9HHZEPJha1DaqKqt4cZB2S2wrL+KCpgUfX/4hn7GQgBEy8K6BOdI tACZ/8TcfW3R7r38qLQJs/J3uHlC81hk7oHW1aay6FGd3h7sRIsQdcoopL1UN/10SJXvh3gj5JYc fcyj3YjSJDM7N9w87eiWPdG9E6rjq5+6a3I8xshnbfXq1/3rFOlRfI6jXT+cH5Rncmej+PpvF2kB KYbOOpBGLGNtKE9UkbT5oDmKkR4wicB+uXKfnHjVGMpcEFsBrteEImuWtzSjRCUyq/zK6hISfDCC BKAwggOIoAMCAQICECB/rlBHxmIeQFcwvy2yiJ0wDQYJKoZIhvcNAQEFBQAwbjFBMD8GA1UEChM4 U2FmZWxheWVyIFNlY3VyZSBDb21tdW5pY2F0aW9ucywgUy5BLiBbQy5JLkYuIEE2MTkzMDA0Nl0x KTAnBgNVBAMTIFNhZmVsYXllciAtIENsYXNzIDEgQ29ycG9yYXRlIENBMB4XDTA0MDMxNjE2NTIx NVoXDTA1MDMxNjE2NTIxNVowfTELMAkGA1UEBhMCRVMxEjAQBgNVBAoTCVNhZmVsYXllcjEUMBIG A1UECxMLRGV2ZWxvcG1lbnQxFzAVBgNVBAMTDkl2YW4gRm9udGFuYWxzMSswKQYJKoZIhvcNAQkB FhxpdmFuLmZvbnRhbmFsc0BzYWZlbGF5ZXIuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB gQCsrYL/MCXAZQQTIUWfCEpREE1lCLLPXB9QVgjMhbDMG9Y7teDk72WVqJrAy9p1jJtb3YvXgEVH bW1HUFqp19fk1De77ZhKlBxRnU3h6SHoc32ORRFQk5b5JZMUGXfkRQoh4fEzkNxIkRCai7y5MGOO E2qyPhyf4jAL16zWtDlnVwIDAQABo4IBrTCCAakwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMC A/gwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGCWCGSAGG+EIBAQQEAwIFoDAdBgNV HQ4EFgQU5PuKUDNocc0SoG6EEo53zOge4BAwgZMGA1UdIwSBizCBiIAUNNuSq/BPy9wTvWipXxvA GMd9ddahbaRrMGkxQTA/BgNVBAoTOFNhZmVsYXllciBTZWN1cmUgQ29tbXVuaWNhdGlvbnMsIFMu QS4gW0MuSS5GLiBBNjE5MzAwNDZdMSQwIgYDVQQDExtTYWZlbGF5ZXIgLSBDbGFzcyAxIFJvb3Qg Q0GCAQwwXAYDVR0gBFUwUzBRBgsrBgEEAaRmAwECATBCMEAGCCsGAQUFBwIBFjRodHRwOi8vY2Eu c2FmZWxheWVyLmNvbS9wb2xpY3kvc2FmZWxheWVyX3BvbGljeS5odG1sMEQGA1UdHwQ9MDswOaA3 oDWGM2h0dHA6Ly9jYS5zYWZlbGF5ZXIuY29tL2NybC9zYWZlbGF5ZXJfY29ycG9yYXRlLmNybDAN BgkqhkiG9w0BAQUFAAOCAQEAlgTfNiGJA4FFqcnka5FfuH3O7+Ar8yGSoqe4OhUBiyzzVK26Apd1 O2usLYPQIS6S9HHZEPJha1DaqKqt4cZB2S2wrL+KCpgUfX/4hn7GQgBEy8K6BOdItACZ/8TcfW3R 7r38qLQJs/J3uHlC81hk7oHW1aay6FGd3h7sRIsQdcoopL1UN/10SJXvh3gj5JYcfcyj3YjSJDM7 N9w87eiWPdG9E6rjq5+6a3I8xshnbfXq1/3rFOlRfI6jXT+cH5Rncmej+PpvF2kBKYbOOpBGLGNt KE9UkbT5oDmKkR4wicB+uXKfnHjVGMpcEFsBrteEImuWtzSjRCUyq/zK6hISfDCCBN4wggPGoAMC AQICAQwwDQYJKoZIhvcNAQEFBQAwaTFBMD8GA1UEChM4U2FmZWxheWVyIFNlY3VyZSBDb21tdW5p Y2F0aW9ucywgUy5BLiBbQy5JLkYuIEE2MTkzMDA0Nl0xJDAiBgNVBAMTG1NhZmVsYXllciAtIENs YXNzIDEgUm9vdCBDQTAeFw0wMjAyMTMxNjA2NTZaFw0xMjAyMTIyMzAwMDBaMG4xQTA/BgNVBAoT OFNhZmVsYXllciBTZWN1cmUgQ29tbXVuaWNhdGlvbnMsIFMuQS4gW0MuSS5GLiBBNjE5MzAwNDZd MSkwJwYDVQQDEyBTYWZlbGF5ZXIgLSBDbGFzcyAxIENvcnBvcmF0ZSBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAKOGW2J3NA4OgTh87dCmmChjFUCRD+/JX0DO7CFGaPfmd/MJcF0r RQDwPIsWMT8RH7miFWMFBN400DcOR7B7AM8YqXRCaeio9Ftuz8eCy1RsXbFXNVZpT93HRCbg6UcV sk9ZeQ+B21OEHPrFSeujZMSmRKS9PuVeIMH+OzQ4aAtB0ocy7ezJrdEgfzAIXKjZlmqn9CB+CN+q ESxq8FxHyKI4GI7RE2sO57AH2tewOcinQrverTBTtjmxBrsSeFA+GhckrRtuEaXgyXsRfunEVva1 MzClwXg3cNd/GUbKf7O/Qh8GAFx6948JQSMcEjQ/OIZFoMQtIad7B0pBvRTpDJ8CAwEAAaOCAYow ggGGMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIA BzAdBgNVHQ4EFgQUNNuSq/BPy9wTvWipXxvAGMd9ddYwgZMGA1UdIwSBizCBiIAURofLRMb7IZis RMWq43mfTjRHwLqhbaRrMGkxQTA/BgNVBAoTOFNhZmVsYXllciBTZWN1cmUgQ29tbXVuaWNhdGlv bnMsIFMuQS4gW0MuSS5GLiBBNjE5MzAwNDZdMSQwIgYDVQQDExtTYWZlbGF5ZXIgLSBDbGFzcyAx IFJvb3QgQ0GCAQEwXwYDVR0gBFgwVjBUBgsrBgEEAaRmAwEBATBFMEMGCCsGAQUFBwIBFjdodHRw Oi8vY2Euc2FmZWxheWVyLmNvbS9wb2xpY3kvc2FmZWxheWVyX3BvbGljeV9DQS5odG1sMDcGA1Ud HwQwMC4wLKAqoCiGJmh0dHA6Ly9jYS5zYWZlbGF5ZXIuY29tL2NybC9jYVJvb3QuY3JsMA0GCSqG SIb3DQEBBQUAA4IBAQC3mPBx6qwQ8V5LVfFydZhJrEuM9WYzOmvNEv+JRmmnWZg2zC9Y9wtjFtQ1 7Jr6Gh/zt1IA4ietqn1J/pu/U4GJSTr8q2huBkKHqZdLb92ZKFAjJUmOrg9Row6CRTKmbghM5B2r uNiC9PedTPXmAcqt+/hJFxW+je/18oI/tgHkQ5X194L9k3qpImyb5Y7Cp70dGPm7Bikn+75ZOJGP L9DydrhEgu4msB2HmlXAPRt52cp2APaP6EBN8Za3QEh/C8cEvC/KuKlOFwBQg5l5tEJ1AU2gkXle V2P4yA8VmQN1xeqW3O+5ytLYfKkrc4Xzq3WSpC61KojctEM5DbEkFSbfMIIE3jCCA8agAwIBAgIB DDANBgkqhkiG9w0BAQUFADBpMUEwPwYDVQQKEzhTYWZlbGF5ZXIgU2VjdXJlIENvbW11bmljYXRp b25zLCBTLkEuIFtDLkkuRi4gQTYxOTMwMDQ2XTEkMCIGA1UEAxMbU2FmZWxheWVyIC0gQ2xhc3Mg MSBSb290IENBMB4XDTAyMDIxMzE2MDY1NloXDTEyMDIxMjIzMDAwMFowbjFBMD8GA1UEChM4U2Fm ZWxheWVyIFNlY3VyZSBDb21tdW5pY2F0aW9ucywgUy5BLiBbQy5JLkYuIEE2MTkzMDA0Nl0xKTAn BgNVBAMTIFNhZmVsYXllciAtIENsYXNzIDEgQ29ycG9yYXRlIENBMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAo4ZbYnc0Dg6BOHzt0KaYKGMVQJEP78lfQM7sIUZo9+Z38wlwXStFAPA8 ixYxPxEfuaIVYwUE3jTQNw5HsHsAzxipdEJp6Kj0W27Px4LLVGxdsVc1VmlP3cdEJuDpRxWyT1l5 D4HbU4Qc+sVJ66NkxKZEpL0+5V4gwf47NDhoC0HShzLt7Mmt0SB/MAhcqNmWaqf0IH4I36oRLGrw XEfIojgYjtETaw7nsAfa17A5yKdCu96tMFO2ObEGuxJ4UD4aFyStG24RpeDJexF+6cRW9rUzMKXB eDdw138ZRsp/s79CHwYAXHr3jwlBIxwSND84hkWgxC0hp3sHSkG9FOkMnwIDAQABo4IBijCCAYYw EgYDVR0TAQH/BAgwBgEB/wIBATAOBgNVHQ8BAf8EBAMCAQYwEQYJYIZIAYb4QgEBBAQDAgAHMB0G A1UdDgQWBBQ025Kr8E/L3BO9aKlfG8AYx3111jCBkwYDVR0jBIGLMIGIgBRGh8tExvshmKxExarj eZ9ONEfAuqFtpGswaTFBMD8GA1UEChM4U2FmZWxheWVyIFNlY3VyZSBDb21tdW5pY2F0aW9ucywg Uy5BLiBbQy5JLkYuIEE2MTkzMDA0Nl0xJDAiBgNVBAMTG1NhZmVsYXllciAtIENsYXNzIDEgUm9v dCBDQYIBATBfBgNVHSAEWDBWMFQGCysGAQQBpGYDAQEBMEUwQwYIKwYBBQUHAgEWN2h0dHA6Ly9j YS5zYWZlbGF5ZXIuY29tL3BvbGljeS9zYWZlbGF5ZXJfcG9saWN5X0NBLmh0bWwwNwYDVR0fBDAw LjAsoCqgKIYmaHR0cDovL2NhLnNhZmVsYXllci5jb20vY3JsL2NhUm9vdC5jcmwwDQYJKoZIhvcN AQEFBQADggEBALeY8HHqrBDxXktV8XJ1mEmsS4z1ZjM6a80S/4lGaadZmDbML1j3C2MW1DXsmvoa H/O3UgDiJ62qfUn+m79TgYlJOvyraG4GQoepl0tv3ZkoUCMlSY6uD1GjDoJFMqZuCEzkHau42IL0 951M9eYByq37+EkXFb6N7/Xygj+2AeRDlfX3gv2TeqkibJvljsKnvR0Y+bsGKSf7vlk4kY8v0PJ2 uESC7iawHYeaVcA9G3nZynYA9o/oQE3xlrdASH8LxwS8L8q4qU4XAFCDmXm0QnUBTaCReV5XY/jI DxWZA3XF6pbc77nK0th8qStzhfOrdZKkLrUqiNy0QzkNsSQVJt8xggHOMIIBygIBATCBgjBuMUEw PwYDVQQKEzhTYWZlbGF5ZXIgU2VjdXJlIENvbW11bmljYXRpb25zLCBTLkEuIFtDLkkuRi4gQTYx OTMwMDQ2XTEpMCcGA1UEAxMgU2FmZWxheWVyIC0gQ2xhc3MgMSBDb3Jwb3JhdGUgQ0ECECB/rlBH xmIeQFcwvy2yiJ0wCQYFKw4DAhoFAKCBojAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0wNDA4MDMxMTIzMjVaMCMGCSqGSIb3DQEJBDEWBBTgpVXGPqAFFhfpj8QKnnpJ IhongTBDBgkqhkiG9w0BCQ8xNjA0MAcGBSsOAwIdMA4GCCqGSIb3DQMCAgIAgDAKBggqhkiG9w0D BzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASBgAm2meiZHF2FXjRu4pkStmoFtYnkTy4d qSXN7PuQxKbMeoiFZB7ZibGAojPu3zPmQyENSOOiLQmcrUCJtgxfXs3vIiByhG/UcK3++m1JoQx9 rqpae+4r2am9UOOMXKQj2pU0ghvAY9bFjtTvMDakRYLzLq/ikQRtyrrAFBXn0wt6AAAAAA== ---------z11711_boundary_sign-- From securityyharris@example.net Tue Aug 03 11:58:08 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 81544 invoked from network); 3 Aug 2004 11:58:08 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 11:58:08 -0000 Received: (qmail 27711 invoked by uid 500); 3 Aug 2004 11:58:05 -0000 Delivered-To: yharris@example.net Received: (qmail 27686 invoked by uid 500); 3 Aug 2004 11:58:05 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 27672 invoked by uid 99); 3 Aug 2004 11:58:04 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-ID: <yharris@example.net> Date: Tue, 03 Aug 2004 21:57:53 +1000 From: Berin Lautenbach <yharris@example.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: yharris@example.net Subject: Re: XmlDsig error with base64Binary Type References: <yharris@example.net> In-Reply-To: <yharris@example.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Ivan, As part of validation, a parser will normalise according to pre-defined rules for each data type. Part of the normalisation process for base64binary types is to collapse white space down to a single space - which will break any signature over that data. Scott indicated that it may be possible to turn off normalisation during the parsing process, but other than that the only other work-around is not to validate during parse. So - to answer your question. If you create a document with a base64binary element that contains new lines and then sign it (using either IAIK and xsec), the resulting file will quite possible fail signature validation under either library if it validated as it is parsed back into memory. The base64binary normalisation process will break the signature. Cheers, Berin yharris@example.net wrote: > > Hi Berin, > well, first of all I would like to thanks you for all the work > and tests done! > > I 'll ckeck the new CVS version, but I have a last question: With this > solved bug, will be possible now to validate a XML signed with XSEC > against IAIK toolkit ? > I mean if the returned Xsec hash will be the same in both > toolkits when exists the base64Binary type in the schema.... > > Again, thank you very much! > > Cheers, > Ivan > >-< > This email has been digitally signed. You can verify its authenticity > by installing Safelayer's Root Certificate: > http://ca.safelayer.com/install_root.html > >-< > > IMPORTANT NOTICE: This communication contains information which is > confidential and may also be privileged. It is for the exclusive use of > the intended recipient(s). If you are not the intended recipient(s) > please note that any form of distribution, copying or use of this > communication or the information in it is strictly prohibited and may be > unlawful. If you have received this communication in error please return > it to the sender. The opinions expressed within this communication are > not necessarily those expressed by Safelayer Secure Communications. > > > *Berin Lautenbach <yharris@example.net>* > > 03/08/2004 13:07 > Please respond to security-dev > > > To: yharris@example.net > cc: > Subject: Re: XmlDsig error with base64Binary Type > > > > > Ivan, > > > 1. Your IAIK sample uses an XPath-Filter that according to my read > > should be the same as an enveloping transforms - but for some reason the > > xsec library is not outputting attributes when canonicalising. This > > looks like a bug in the library, and would explain why the IAIK sample > > does not validate. > > There *was* a bug in the library. There was a case where attribute > nodes would get dropped from the input nodeset that is passed to the > xpath-filter transform. I've checked a fix into CVS and the CVS code > now validates the IAIK sample as OK. > > Cheers, > Berin > > From securityyharris@example.net Tue Aug 03 14:01:14 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 62762 invoked from network); 3 Aug 2004 14:01:14 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 14:01:14 -0000 Received: (qmail 45360 invoked by uid 500); 3 Aug 2004 14:01:00 -0000 Delivered-To: yharris@example.net Received: (qmail 45268 invoked by uid 500); 3 Aug 2004 14:01:00 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 45199 invoked by uid 99); 3 Aug 2004 14:00:58 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org Message-Id: <yharris@example.net> From: "Scott Cantor" <yharris@example.net> To: <yharris@example.net> Subject: RE: XmlDsig error with base64Binary Type Date: Tue, 3 Aug 2004 10:00:34 -0400 Organization: The Ohio State University MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Thread-index: AcR5USOcZcgao4UhQneFOJPexUSo4QAEPfMg In-reply-to: <yharris@example.net> X-CanItPRO-Stream: default X-Spam-Score: undef - spam-scanning disabled X-Scanned-By: CanIt (www . canit . ca) X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N > Scott indicated that it may be possible to turn off normalisation during > the parsing process, but other than that the only other work-around is > not to validate during parse. It is possible with Xerces, we do it in OpenSAML to enable signing a signed object, which of course includes base64 data. There's a parser "feature" or whatever they call it to disable schema normalization. -- Scott From securityyharris@example.net Tue Aug 03 16:29:54 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 59412 invoked from network); 3 Aug 2004 16:29:54 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 16:29:54 -0000 Received: (qmail 45314 invoked by uid 500); 3 Aug 2004 16:29:42 -0000 Delivered-To: yharris@example.net Received: (qmail 45267 invoked by uid 500); 3 Aug 2004 16:29:41 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 45233 invoked by uid 99); 3 Aug 2004 16:29:41 -0000 X-ASF-Spam-Status: No, hits=1.5 required=10.0 tests=ALL_TRUSTED,INVALID_DATE X-Spam-Check-By: apache.org Date: 03 Aug 04 16:25:20 From: Sam Ruby <yharris@example.net> To: yharris@example.net Subject: [GUMP@brutus]: xml-security/xml-security failed X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N To whom it may engage... This is an automated request, but not an unsolicited one. For more information please visit http://gump.apache.org/nagged.html, and/or contact folk at yharris@example.net. Project xml-security has an issue affecting its community integration. This issue affects 2 projects. Project State : 'Failed', Reason 'Build Failed' The following are affected: - wss4j : Web Services Security (WS-Security) Java Implemenatation - xml-security : XML-Signature Syntax and Processing Full details are available at: http://brutus.apache.org/gump/public/xml-security/xml-security/index.html That said, some snippets follow: The following annotations were provided: -DEBUG- Sole jar [xmlsec.jar] identifier set to project name -DEBUG- Dependency on jce exists, no need to add for property lib.jce. -INFO- Enable "verbose" output, due to 0 previous error(s). -INFO- Failed with reason build failed -INFO- Enable "debug" output, due to build failure. The following work was performed: http://brutus.apache.org/gump/public/xml-security/xml-security/gump_work/build_xml-security_xml-security.html Work Name: build_xml-security_xml-security (Type: Build) State: Failed Elapsed: 23 secs Command Line: java -Djava.awt.headless=true -Dbuild.clonevm=true -Xbootclasspath/p:/usr/local/gump/public/workspace/xml-xerces2/java/build/xercesImpl.jar:/usr/local/gump/public/workspace/xml-xerces2/java/build/xml-apis.jar:/usr/local/gump/public/workspace/xml-xalan/java/build/xalan-unbundled.jar:/usr/local/gump/public/workspace/xml-commons/java/external/build/xml-apis.jar org.apache.tools.ant.Main -verbose -Dgump.merge=/usr/local/gump/public/gump/work/merge.xml -Dbuild.sysclasspath=only -Djce.download.sha1=c1f0e975e8c8e0a0105787b249a50615b485d109 -Dlib.jce=/usr/local/gump/packages/jce/jce-jdk13-116.jar -Djce.download.md5=85c64cd754719a4bc8da7e9aa0e113fd gump [Working Directory: /usr/local/gump/public/workspace/xml-security] CLASSPATH : /usr/local/j2sdk1.4.2_04/lib/tools.jar:/usr/local/gump/public/workspace/xml-security/build/classes:/usr/local/gump/public/workspace/xml-security:/usr/local/gump/public/workspace/ant/dist/lib/ant-stylebook.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-jmf.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-swing.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-trax.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-junit.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-launcher.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant-nodeps.jar:/usr/local/gump/public/workspace/ant/dist/lib/ant.jar:/usr/local/gump/packages/jce/jce-jdk13-116.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging.jar:/usr/local/gump/public/workspace/jakarta-commons/logging/dist/commons-logging-api.jar:/usr/local/gump/public/workspace/dist/junit/junit.jar--------------------------------------------- [junit] at java.lang.ClassLoader.loadClass(ClassLoader.java:289) [junit] at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:274) [junit] at java.lang.ClassLoader.loadClass(ClassLoader.java:235) [junit] at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:302) [junit] at java.lang.Class.forName0(Native Method) [junit] at java.lang.Class.forName(Class.java:141) [junit] Test org.apache.xml.security.test.utils.resolver.ResourceResolverSpiTest FAILED Override ignored for property build.test.failed [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.helper.AttrCompareTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.helper.C14nHelperTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.C14NInteropTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.Canonicalizer20010315ExclusiveTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.Canonicalizer20010315Test.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.c14n.implementations.ExclusiveC14NInterop.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.encryption.BaltimoreEncTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.encryption.XMLCipherTester.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.external.org.apache.xalan.XPathAPI.AttributeAncestorOrSelfTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.external.org.apache.xalan.XPathAPI.XalanBug1425Test.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.interop.BaltimoreTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.interop.IAIKTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.interop.RSASecurityTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.signature.XMLSignatureInputTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.transforms.implementations.TransformBase64DecodeTest.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.utils.Base64Test.xml' [junitreport] Parsing file: '/usr/local/gump/public/workspace/xml-security/build/docs/xml/junit/TEST-org.apache.xml.security.test.utils.resolver.ResourceResolverSpiTest.xml' [junitreport] Using org.apache.xalan.processor Xalan Java 2.6.0 [junitreport] Transform time: 4261ms BUILD FAILED /usr/local/gump/public/workspace/xml-security/build.xml:396: Unit Tests yharris@example.net(Exit.java:139) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:324) at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:95) at org.apache.tools.ant.Task.perform(Task.java:366) at org.apache.tools.ant.Target.execute(Target.java:337) at org.apache.tools.ant.Target.performTasks(Target.java:365) at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1218) at org.apache.tools.ant.Project.executeTarget(Project.java:1188) at org.apache.tools.ant.Project.executeTargets(Project.java:1060) at org.apache.tools.ant.Main.runBuild(Main.java:673) at org.apache.tools.ant.Main.startAnt(Main.java:188) at org.apache.tools.ant.Main.start(Main.java:151) at org.apache.tools.ant.Main.main(Main.java:241) Total time: 22 seconds --------------------------------------------- To subscribe to this information via syndicated feeds: RSS: http://brutus.apache.org/gump/public/xml-security/xml-security/rss.xml Atom: http://brutus.apache.org/gump/public/xml-security/xml-security/atom.xml -- Gump E-mail Identifier (within run) #18. Produced by Gump 2.1.0-alpha-0002. [Run (20040803 08:07:05, brutus:brutus-public:20040803 08:07:05)] http://brutus.apache.org/gump/public/index.html http://brutus.apache.org/gump/public/options.html -- Apache Gump http://gump.apache.org/ [Instance: brutus] From securityyharris@example.net Tue Aug 03 18:07:17 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 17549 invoked from network); 3 Aug 2004 18:07:16 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 18:07:16 -0000 Received: (qmail 50093 invoked by uid 500); 3 Aug 2004 18:07:13 -0000 Delivered-To: yharris@example.net Received: (qmail 50045 invoked by uid 500); 3 Aug 2004 18:07:12 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 50030 invoked by uid 99); 3 Aug 2004 18:07:12 -0000 X-ASF-Spam-Status: No, hits=1.1 required=10.0 tests=NO_REAL_NAME,UPPERCASE_25_50 X-Spam-Check-By: apache.org Date: 3 Aug 2004 18:08:39 -0000 Message-ID: <yharris@example.net> From: yharris@example.net To: yharris@example.net Cc: Subject: DO NOT REPLY [Bug 29188] - Minor clean-ups and speed/memory improvment X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=29188>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=29188 Minor clean-ups and speed/memory improvment yharris@example.net changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED ------- Additional Comments From yharris@example.net 2004-08-03 18:08 ------- Patch applied. Time to test ;) From securityyharris@example.net Tue Aug 03 18:08:49 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 18296 invoked from network); 3 Aug 2004 18:08:49 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 18:08:49 -0000 Received: (qmail 51614 invoked by uid 500); 3 Aug 2004 18:08:47 -0000 Delivered-To: yharris@example.net Received: (qmail 51543 invoked by uid 500); 3 Aug 2004 18:08:46 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 51530 invoked by uid 99); 3 Aug 2004 18:08:46 -0000 X-ASF-Spam-Status: No, hits=1.3 required=10.0 tests=NO_REAL_NAME,UPPERCASE_50_75 X-Spam-Check-By: apache.org Date: 3 Aug 2004 18:10:16 -0000 Message-ID: <yharris@example.net> From: yharris@example.net To: yharris@example.net Cc: Subject: DO NOT REPLY [Bug 28752] - Some patches for c14 and various other improvment X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=28752>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=28752 Some patches for c14 and various other improvment yharris@example.net changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED From securityyharris@example.net Tue Aug 03 22:05:57 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 20302 invoked from network); 3 Aug 2004 22:05:57 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 22:05:57 -0000 Received: (qmail 31622 invoked by uid 500); 3 Aug 2004 22:05:54 -0000 Delivered-To: yharris@example.net Received: (qmail 31599 invoked by uid 500); 3 Aug 2004 22:05:53 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 31586 invoked by uid 99); 3 Aug 2004 22:05:53 -0000 X-ASF-Spam-Status: No, hits=0.6 required=10.0 tests=NO_REAL_NAME X-Spam-Check-By: apache.org Date: 3 Aug 2004 22:07:21 -0000 Message-ID: <yharris@example.net> From: yharris@example.net To: yharris@example.net Cc: Subject: DO NOT REPLY [Bug 30455] New: - Java xml-sec large document signing improvements. X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=30455>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=30455 Java xml-sec large document signing improvements. Summary: Java xml-sec large document signing improvements. Product: Security Version: unspecified Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: Other Component: Signature AssignedTo: yharris@example.net ReportedBy: yharris@example.net I have just created a new patch that tries to fix the problems that xml-sec library has when signed big documents. In the tests the memory consumption goes from 18meg to 12meg, but the bigger document the bigger the savings(at least you use juice or native jce that doesn't implement correctly the update methods). But as I don't have any big test, I have uploaded a compiled .jar so people that have report problems can test it and share their experience. This patch is little hacky and makes some tests to fail (the detached ones), but if it improves the thing I'll fix it. Regards, From securityyharris@example.net Tue Aug 03 22:08:03 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 20821 invoked from network); 3 Aug 2004 22:08:02 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 22:08:02 -0000 Received: (qmail 34964 invoked by uid 500); 3 Aug 2004 22:08:00 -0000 Delivered-To: yharris@example.net Received: (qmail 34944 invoked by uid 500); 3 Aug 2004 22:08:00 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 34931 invoked by uid 99); 3 Aug 2004 22:07:59 -0000 X-ASF-Spam-Status: No, hits=1.1 required=10.0 tests=NO_REAL_NAME,UPPERCASE_25_50 X-Spam-Check-By: apache.org Date: 3 Aug 2004 22:09:29 -0000 Message-ID: <yharris@example.net> From: yharris@example.net To: yharris@example.net Cc: Subject: DO NOT REPLY [Bug 30455] - Java xml-sec large document signing improvements. X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=30455>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=30455 Java xml-sec large document signing improvements. ------- Additional Comments From yharris@example.net 2004-08-03 22:09 ------- Created an attachment (id=12318) A test jar From securityyharris@example.net Tue Aug 03 22:17:12 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 23599 invoked from network); 3 Aug 2004 22:17:12 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 3 Aug 2004 22:17:12 -0000 Received: (qmail 42465 invoked by uid 500); 3 Aug 2004 22:17:09 -0000 Delivered-To: yharris@example.net Received: (qmail 42448 invoked by uid 500); 3 Aug 2004 22:17:09 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 42435 invoked by uid 99); 3 Aug 2004 22:17:09 -0000 X-ASF-Spam-Status: No, hits=1.1 required=10.0 tests=NO_REAL_NAME,UPPERCASE_25_50 X-Spam-Check-By: apache.org Date: 3 Aug 2004 22:18:38 -0000 Message-ID: <yharris@example.net> From: yharris@example.net To: yharris@example.net Cc: Subject: DO NOT REPLY [Bug 30455] - Java xml-sec large document signing improvements. X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=30455>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://issues.apache.org/bugzilla/show_bug.cgi?id=30455 Java xml-sec large document signing improvements. ------- Additional Comments From yharris@example.net 2004-08-03 22:18 ------- Created an attachment (id=12319) The hacky patch From securityyharris@example.net Wed Aug 04 05:43:03 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 70121 invoked from network); 4 Aug 2004 05:43:03 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (83.161.120.155) by minotaur-2.apache.org with SMTP; 4 Aug 2004 05:43:03 -0000 Received: (qmail 20371 invoked by uid 500); 4 Aug 2004 05:42:48 -0000 Delivered-To: yharris@example.net Received: (qmail 20352 invoked by uid 500); 4 Aug 2004 05:42:48 -0000 Mailing-List: contact yharris@example.net; run by ezmlm Precedence: bulk List-Post: <mailto:yharris@example.net> List-Help: <mailto:yharris@example.net> List-Unsubscribe: <mailto:yharris@example.net> List-Subscribe: <mailto:yharris@example.net> Reply-To: yharris@example.net Delivered-To: mailing list yharris@example.net Received: (qmail 20339 invoked by uid 99); 4 Aug 2004 05:42:47 -0000 X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= X-Spam-Check-By: apache.org From: "Milan Tomic" <yharris@example.net> To: <yharris@example.net> Subject: RE: Encrypting with multiple public keys Date: Wed, 4 Aug 2004 07:42:33 +0200 Message-ID: <005f01c479e5$da39a8a0$ce018ac1@Majestix> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 In-Reply-To: <yharris@example.net> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Importance: Normal X-Virus-Scanned: by yharris@example.net X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N > Is an exception being thrown at all? Yes, the exception message is "WinCAPI:RSA privateKeyDecrypt - Error Decrypting PKCS1_5 padded RSA encrypt" in WinCAPICryptoKeyRSA.cpp. > I had a quick check of > the code, > and theoretically it should be looping through all the key > infos until a > decrypt succeeds. I've noticed that, too. > Unfortunately it looks like it won't handle an > exception cleanly (this is probably one of those cases where > they should > be quietly ignored), so that may be what is causing the problem. I agree. Best regards, Milan From securityyharris@example.net Wed Aug 04 09:00:02 2004 Return-Path: <securityyharris@example.net> Delivered-To: yharris@example.net Received: (qmail 64107 invoked from network); 4 Aug 2004 09:00:02 -0000 Received: from hermes.apache.org
{'source': 'Apache Software Foundation Public Mail Archives'}