Re: draft-ietf-xmldsig-xc14n-00.txt

["Steven M. Bellovin" <smb@research.att.com>]

In message <E19ACtA-00040E-Df@roam.psg.com>, Randy Bush writes:
>well, smb asked me to review this one.  but i do not meet the
>condition stated in 1.0
>
>   An understanding of the Canonical XML Recommendation [XML-C14N]
>   is required.
>
>except s/understanding/reading/.  and i am on a plane, so can not
>dereference the w3.org urls.  so take my comments with a generous
>dipping of shoyu.
>
>1.3.1 demands non-imported namespaces be redeclared at apex nodes,
>or in the interpreting context.  i would think that, alternatively
>but maybe not deeply interestingly, they might be declared at
>orphans which are ancestors of all uses.
>
>3.1.3.4 is missing the verb clause.  i think it is likely that of
>3.1.3.3, i.e., render a default namespace declaration, xmlns="".
>
>the sec cons statements seem semantically correct and complete.
>whether you dislike the restriction in 5.2, esoteric cases,
>sufficiently to special case it would seem to depend on your
>willingness to get kinky to deal with non-well-formed xml.  i am
>not so willing.
>

I think, then, that my objections can be satisifed by s/must/MUST/ in
1.3(1) and (2).

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)