3 ms·
I implemented XML Signatures at our org for Payments Interface (MPI) with Card Networks and there is a part of my brain that will forever curse me for reading t
by captn3m0 7y ago
I implemented XML Signatures at our org for Payments Interface (MPI) with Card Networks and there is a part of my brain that will forever curse me for reading the XMLDSig spec.
How anyone ever thought XML Canonicalization was the right answer is beyond me.
- marcosdumay 7y agoXML being the way it is, I don't think there was any alternative to canonicalization.
- tomjen3 7y agoOf the top of my head: embed the XML as a pchar, sign only that; and the insert the signature as another XML value. Then you only parse the outside XML, extract the inner value and validate the signature, then you validate the inner value as-is, so no XML changes will undo the signature.
- marcosdumay 7y agoOk, you do not need to keep the signature at the same document you are signing. But you'll have to canonicalize your XML anyway. There are plenty of security issues with signing non-canonical XML.