ebxml-msg — archive

[System]

Regardless of whether the original message is signed or not, the reference element of a signed acknowledgment SHOULD ALWAYS be computed, not copied from the original message, by the receiving party. I don't think that we can say MUST in this situation but it is a REALLY BAD IDEA to simply copy the received digest in this case. Cheers, Chris Arvola Chan wrote: > I was originally objecting to the following statement on line 1557: > > "If the original message is not signed, the [XMLDSIG] Reference element must > be derived from the original message (see section 4.1.3)." > > I think the use of "must" is too strong. Is it conceivable that a receiver > MSH may have the policy of not returning a signed Acknowledgment unless the > original message is also signed? I think it should be allowed to return an > error or warning indicating an error code of Inconsistent or NotSupported. > It should also be allow to comply with the signed AckRequested directive if > it chooses to. > > Regarding Rich's comment that a service may want to sign everything it > generates, an Acknowledgment message can always be signed. The issue is > whether the Acknowledgment element needs to include ds:Reference elements > that contain digests for the MIME parts of the original message. I don't > think it is reasonable to mandate that the receiver MUST calculate the > digests if they were not included in the original message in the first > place. > > Regards, > -Arvola > >