<div dir="ltr"><div>Resolved!</div><div><br></div><div>I realized that using standard transformers, external URI only use ArchiveTimeStamp canonicalization transform if ds:reference contains the XPath transform as last transform.</div>
<div><br></div><div>So, external URI="fakefile.xml#child1" result "octet stream" and external URI="fakefile.xml" with transform Xpath to get child1 result "node set".</div><div><br>
</div><div>In the end I was the one complicating.</div><div><br></div><div>Thank you for contacting.</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 30, 2013 at 7:13 PM, Aleksey Sanin <span dir="ltr"><<a href="mailto:aleksey@aleksey.com" target="_blank">aleksey@aleksey.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">You should probably ask xadec people. They are inventing new way to do<br>
signatures that has nothing to do with w3c xmldsig spec. I have no idea<br>
what are they trying to do.<br>
<br>
Aleksey<br>
<div class="im"><br>
On 8/30/13 9:03 AM, Alexwell Sandro wrote:<br>
> Sorry for the confusion.<br>
><br>
> The digest transform require an "octet stream". So all retrieved data<br>
> can be used as "octet stream".<br>
><br>
</div>> But, ArchiveTimeStamp from /XML Advanced Electronic Signatures<br>
> <<a href="http://www.etsi.org/deliver/etsi_ts%5C101900_101999%5C101903%5C01.04.02_60%5Cts_101903v010402p.pdf" target="_blank">http://www.etsi.org/deliver/etsi_ts%5C101900_101999%5C101903%5C01.04.02_60%5Cts_101903v010402p.pdf</a>>/ (page<br>
<div class="im">> 58) seems refers to "The Reference Process Model<br>
</div>> <<a href="http://www.w3.org/TR/xmldsig-core/#sec-ReferenceProcessingModel" target="_blank">http://www.w3.org/TR/xmldsig-core/#sec-ReferenceProcessingModel</a>>"<br>
<div class="im">> without the digest transform, because the digest algorithm may be weak.<br>
><br>
</div>> *I will try to explain:*<br>
><br>
> If I signed a detached file, using Xpath to get the node "*child*" and<br>
<div class="im">> apply exc-c14n:<br>
><br>
> - FakeFile.xml<br>
><br>
> <file xmlns:ns1="ns1"><br>
</div>> *<child>Text<child>*<br>
> <file/><br>
><br>
> I know that the *<child>Text<child> *is a "node set" with in<br>
<div class="im">> FakeFile.xml. So I can use exc-c14n or inc-c14n.<br>
><br>
> But after retrieved process without apply digest transform. Is this "nod<br>
> set" or "octet strem"?<br>
><br>
</div>> *The Reference process Model says:*<br>
><br>
> /Unless the URI-Reference is such a 'same-document' reference , the<br>
<div class="im">> result of dereferencing the URI-Reference MUST be an octet stream.<br>
</div>> /<br>
> /<br>
> /<br>
<div class="im">> /URI="<a href="http://example.com/bar.xml#chapter1" target="_blank">http://example.com/bar.xml#chapter1</a>" /<br>
> /Identifies the element with ID attribute value 'chapter1' of the<br>
</div><div class="im">> external XML resource '<a href="http://example.com/bar.xml" target="_blank">http://example.com/bar.xml</a>', provided as an octet<br>
</div>> stream./<br>
<div class="im">><br>
> "provided as an octet stream" is the resource or the element?<br>
><br>
</div>> Consider a signature over the digest "sha1" of "*<child>Text<child>*"<br>
><br>
> *Now the algorithm is weak, and I want to add ArchiveTimeStamp, the<br>
<div class="im">> Specification says:*<br>
><br>
> /Process the retrieved ds:Reference element according to the reference<br>
> processing model of XMLDSIG./<br>
> /<br>
> /<br>
</div>> /If the result is a XML node set, canonicalize it. If<br>
<div class="im">> ds:Canonicalization is present, the algorithm indicated by this element<br>
> is used. If not, the standard canonicalization method specified by<br>
</div>> XMLDSIG is used./<br>
><br>
> *I can understand this like: Get data using URI and ds:Transforms<br>
> without apply digest transform.*<br>
><br>
> So I will get *<child>Text<child> (*without digest transform)*, *if this<br>
<div class="im">> is XML node set, canonicalize it.<br>
</div>> *<br>
<div class="im">> *<br>
> But this is a problem.<br>
</div>> *<br>
<div class="im">> *<br>
> If I consider the result of extern URI as a "node set" to apply<br>
> ArchiveTimeStamp and the canonicalize transform used by Archive is<br>
> inc-c14n, I will archive another file.<br>
</div>> *<br>
> *<br>
> *<child *xmlns:ns1="ns1"*>Text<child>*<br>
> *<br>
> *<br>
> *If the documento change:*<br>
> *<br>
<div class="im">> *<br>
> <file xmlns:ns1="ns1" xmlns:ns2="ns2"><br>
</div>> *<child>Text<child>*<br>
> <file/><br>
> *<br>
> *<br>
> *I will try to verify the **ArchiveTimeStamp with:*<br>
> *<br>
> *<br>
> *<child *xmlns:ns1="ns1" xmlns:ns2="ns2"*>Text<child>. *<br>
> *<br>
> *<br>
> *The process to verify will fail. Because the Archive is over:*<br>
> *<br>
> *<br>
> *<child *xmlns:ns1="ns1"*>Text<child>**<br>
> *<br>
> *<br>
> *<br>
> *The question.*<br>
> *<br>
<div class="im">> *<br>
> *For these References:*<br>
><br>
</div>> <ds:Reference Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a> <<a href="http://fakefile.xml/" target="_blank">http://fakefile.xml/</a>>"><br>
<div class="im">> ...<br>
> (empty transform list)<br>
> ...<br>
> </ds:Reference><br>
> *Result 1#: ( <file> ... childs ... <file> ).*<br>
><br>
</div>> <ds:Reference Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a> <<a href="http://fakefile.xml/" target="_blank">http://fakefile.xml/</a>>"><br>
<div class="im">> ...<br>
> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> ...<br>
> </ds:Reference><br>
> *Result 2#: (xml with exc-c14n).*<br>
><br>
</div>> <ds:Reference Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a> <<a href="http://fakefile.xml/" target="_blank">http://fakefile.xml/</a>>"><br>
<div class="im">> ...<br>
> <ds:Transform "fake_Xpath_transform_to_get_all_childs"/><br>
> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> ...<br>
> </ds:Reference><br>
> *Result 3#: ( only childs with exc-c14n <child_1/>...<child_x/> ) This<br>
> is not valid XML file to parse, does not has single root. But can be<br>
> "node set" with in fakefile.xml context.*<br>
><br>
> *Are results (1#, 2# and 3#) "octet stream" ?*<br>
><br>
> Because: /Unless the URI-Reference is such a 'same-document' reference,<br>
> the result of dereferencing the URI-Reference MUST be an octet stream./<br>
><br>
> *Or are they "XML node set" required by XML Advanced Electronic<br>
> Signatures to canonicalize?*<br>
><br>
> Because: /(...) In particular, an XML document identified by URI is not<br>
> parsed by the signature application unless the URI is a same-document<br>
> reference *or unless a transform that requires XML parsing is applied*./<br>
><br>
> *Or the (unless a transform that requires XML parsing is applied) is<br>
> valid only with in Reference context and the results are octet stream?*<br>
><br>
</div><div class="im">> Thanks<br>
><br>
><br>
><br>
> On Fri, Aug 30, 2013 at 12:05 PM, Aleksey Sanin <<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a><br>
</div><div><div class="h5">> <mailto:<a href="mailto:aleksey@aleksey.com">aleksey@aleksey.com</a>>> wrote:<br>
><br>
> I don't understand your question. At the end, digest is always<br>
> applied to the octet stream. The rules in the spec describe how<br>
> to get to the octet stream. In human language, there are only<br>
> two rules:<br>
><br>
> 1) Do not parse to XML unless it is necessary: it is already<br>
> parsed (same document) or there is an XML transform (e.g. XPath)<br>
> 2) To convert back to octet stream use the specified c14n method.<br>
><br>
> IMHO, it's pretty straightforward and logical.<br>
><br>
> Best,<br>
><br>
> Aleksey<br>
><br>
> On 8/30/13 6:50 AM, Alexwell Sandro wrote:<br>
> > I do not know if this is the list for this discussion.<br>
> ><br>
> > I added this question to stackoverflow<br>
> ><br>
> <<a href="http://stackoverflow.com/questions/18522211/xmldsig-the-reference-processing-model-node-set-vs-octet-stream" target="_blank">http://stackoverflow.com/questions/18522211/xmldsig-the-reference-processing-model-node-set-vs-octet-stream</a>>.<br>
> ><br>
> > I'm studying XML Advanced Electronic Signatures<br>
> ><br>
> <<a href="http://www.etsi.org/deliver/etsi_ts%5C101900_101999%5C101903%5C01.04.02_60%5Cts_101903v010402p.pdf" target="_blank">http://www.etsi.org/deliver/etsi_ts%5C101900_101999%5C101903%5C01.04.02_60%5Cts_101903v010402p.pdf</a>>.<br>
> ><br>
> > *To create "ArchiveTimeStamp" (page 58) the Specification says:*<br>
> ><br>
> > /Process the retrieved ds:Reference element according to the reference<br>
> > processing model of XMLDSIG./<br>
> > /<br>
> > /<br>
> > /If the result is a XML node set, canonicalize it. (...)/<br>
> ><br>
> > *The Reference Processing Model is over this:*<br>
> ><br>
> > <*ds:Reference *Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a>"><br>
> > <*ds:Transforms*><br>
> > <ds:Transform<br>
> Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> > </ds:Transforms><br>
> > <ds:DigestMethod/><br>
> > <ds:DigestValue/><br>
> > </ds:Reference><br>
> ><br>
> > The process uses "URI=..." and "ds:Transforms" to retrieve the data.<br>
> ><br>
> > *Below are some parts extracted from (4.3.3.2 The Reference Processing<br>
> > Model<br>
> <<a href="http://www.w3.org/TR/xmldsig-core/#sec-ReferenceProcessingModel" target="_blank">http://www.w3.org/TR/xmldsig-core/#sec-ReferenceProcessingModel</a>>):*<br>
> ><br>
> > /The data-type of the result of URI dereferencing or subsequent<br>
> > Transforms is either an octet stream or an XPath node-set. (...)/<br>
> > /<br>
> > /<br>
> > /In this specification, a 'same-document' reference is defined as a<br>
> > URI-Reference that consists of a hash sign ('#') followed by a<br>
> fragment<br>
> > or alternatively consists of an empty URI (...)/<br>
> > /<br>
> > /<br>
> > /Unless the URI-Reference is such a 'same-document' reference, the<br>
> > result of dereferencing the URI-Reference MUST be an octet stream. In<br>
> > particular, an XML document identified by URI is not parsed by the<br>
> > signature application unless the URI is a same-document reference or<br>
> > unless a transform that requires XML parsing is applied./<br>
> > /<br>
> > /<br>
> > /The following examples demonstrate what the URI attribute identifies<br>
> > and how it is dereferenced:/<br>
> > /<br>
> > /<br>
> > /URI="<a href="http://example.com/bar.xml" target="_blank">http://example.com/bar.xml</a>" /<br>
> > /Identifies the octets (...)/<br>
> > /<br>
> > /<br>
> > /URI="<a href="http://example.com/bar.xml#chapter1" target="_blank">http://example.com/bar.xml#chapter1</a>" /<br>
> > /Identifies the element with ID attribute value 'chapter1' of the<br>
> > external XML resource (...), provided as an octet stream. (...)/<br>
> > /<br>
> > /<br>
> > /URI="" /<br>
> > /Identifies the node-set (...)/<br>
> > /<br>
> > /<br>
> > /URI="#chapter1" /<br>
> > /Identifies a node-set containing the (...)/<br>
> ><br>
> > *The question.*<br>
> ><br>
> > *For these References:*<br>
> ><br>
> > <ds:Reference Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a>"><br>
> > ...<br>
> > (empty transform list)<br>
> > ...<br>
> > </ds:Reference><br>
> > *Result 1#: ( <file> ... childs ... <file> ).*<br>
> ><br>
> > <ds:Reference Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a>"><br>
> > ...<br>
> > <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> > ...<br>
> > </ds:Reference><br>
> > *Result 2#: (xml with exc-c14n).*<br>
> ><br>
> > <ds:Reference Id="myId" URI="<a href="http://fakefile.xml" target="_blank">http://fakefile.xml</a>"><br>
> > ...<br>
> > <ds:Transform "fake_Xpath_transform_to_get_all_childs"/><br>
> > <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> > ...<br>
> > </ds:Reference><br>
> > *Result 3#: ( only childs with exc-c14n <child_1/>...<child_x/> ) This<br>
> > is not valid XML file to parse, does not has single root. But can be<br>
> > "node set" with in fakefile.xml context.*<br>
> ><br>
> > *Are results (1#, 2# and 3#) "octet stream" ?*<br>
> ><br>
> > Because: /Unless the URI-Reference is such a 'same-document'<br>
> reference,<br>
> > the result of dereferencing the URI-Reference MUST be an octet<br>
> stream./<br>
> ><br>
> > *Or are they "XML node set" required by XML Advanced Electronic<br>
> > Signatures to canonicalize?*<br>
> ><br>
> > Because: /(...) In particular, an XML document identified by URI<br>
> is not<br>
> > parsed by the signature application unless the URI is a same-document<br>
> > reference *or unless a transform that requires XML parsing is<br>
> applied*./<br>
> ><br>
> > *Or the (unless a transform that requires XML parsing is applied) is<br>
> > valid only with in Reference context and the results are octet<br>
> stream?*<br>
> ><br>
> > Articles are welcome.<br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > xmlsec mailing list<br>
</div></div>> > <a href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a> <mailto:<a href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a>><br>
> > <a href="http://www.aleksey.com/mailman/listinfo/xmlsec" target="_blank">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
<div class="HOEnZb"><div class="h5">> ><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> xmlsec mailing list<br>
> <a href="mailto:xmlsec@aleksey.com">xmlsec@aleksey.com</a><br>
> <a href="http://www.aleksey.com/mailman/listinfo/xmlsec" target="_blank">http://www.aleksey.com/mailman/listinfo/xmlsec</a><br>
><br>
</div></div></blockquote></div><br></div>