At 2015-05-28 01:39 +0100, Norman Gray wrote:
>Many thanks for your very thoughtful comments -- this is exactly the
>sort of pushback I was hoping to get from xml-dev folk.
I'm pleased! (though "push-back" to me has such a negative
connotation; I was trying to be receptive to your ideas but felt
compelled to comment where I was having difficulty)
I would only make one observation regarding your follow-up, which I
think is crux. I could summarize this as the massaging of content.
>Where this 'Xoxa' approach scores is I think in two places:
>
> * The 'Xoxa' equivalence class of documents is larger than for
> XML C14N. This is not a disadvantage, and I return to it below.
But this gets me very nervous, and I'm glad you included an example.
>This 'Xoxa' procedure implies a larger equivalence class than the
>C18N one. Two documents such as '<p>one two&</p>' and
>'<p>one \n\r two</p>' will have different infosets but the
>same Xoxa canonicalisation.
They have different infosets because there is different information
in the two documents! The white-space is different, and like it or
not, the relevance of white-space is up to sender and receiver, not
to the tools they use. (I'll omit the accidental typo of the numeric
character reference being incorrect :{)})
Now the two documents '<p>one two&</p>' and '<p>one
two&</p>' *are* equivalent, because the information therein is
the same, they just happen to be expressed differently.
Remember that canonicalization is not only used for digital
signatures. I would use canonicalization to know that two documents
are identical in the information they serialize, independent of the
choices made in the syntax of the two serializations.
> * In many cases this won't matter. One might even guess that
> most XML applications (for some value of 'most') will try hard to
> normalise those differences away. At any rate, this approach would
> only apply to that (important) subset of applications where this
> doesn't matter.
But what process determines that it does nor does not matter? An
arm's length digital signature specification would surely have to be
agnostic on content while providing consistent results.
>Xoxa normalizes that subset
But it should not normalize *content* ... it should be agnostic to
content and normalize only the representation. I believe that is
what canonicalization does: I understand that it normalizes the
representation of the information without changing the information one iota.
Hence its applicability in comparing two XML documents, and in
applications where the content of a document (not the representation
of the document) has to be digitally signed.
Good luck in your continued explorations!
. . . . . . . Ken
--
Check our site for free XML, XSLT, XSL-FO and UBL developer resources |
Free 5-hour lecture: http://www.CraneSoftwrights.com/links/video.htm |
Crane Softwrights Ltd. http://www.CraneSoftwrights.com/m/ |
G. Ken Holman mailto: |
Google+ profile: http://plus.google.com/+GKenHolman-Crane/about |
Legal business disclaimers: http://www.CraneSoftwrights.com/legal |
---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com
