I understand that this can be done, but in the scenario where I don't know the third party and the intermediary sends the document to someone I don't know, how does that technique sold the problem. Am I missing something here? If...]]> Fri, 17 Jun 2005 09:27:21 -0400 Fri, 17 Jun 2005 09:27:21 -0400 Fri, 17 Jun 2005 09:27:21 -0400 Jun 17, 2005 peter lin 0 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 I understand that this can be done, but in the scenario where I don't know the third party and the intermediary sends the document to someone I don't know, how does that technique sold the problem. Am I missing something here? If I don't know...]]> Fri, 17 Jun 2005 04:42:14 -0400 Fri, 17 Jun 2005 04:42:14 -0400 Fri, 17 Jun 2005 04:42:14 -0400 Jun 17, 2005 Pavel Tavoda 1 http://www.theserverside.com/discussions/thread.tss?thread_id=34509

You are still mixing. We have two independent things. First is signing, second is...]]> Thu, 16 Jun 2005 17:24:48 -0400 Thu, 16 Jun 2005 17:24:48 -0400 Thu, 16 Jun 2005 17:24:48 -0400 Jun 16, 2005 peter lin 2 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 Thu, 16 Jun 2005 15:49:02 -0400 Thu, 16 Jun 2005 15:49:02 -0400 Thu, 16 Jun 2005 15:49:02 -0400 Jun 16, 2005 Pavel Tavoda 3 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 The message authentication scheme (hmac) has a lot of real world application, use cases that do not require encryption, just being to able to say "yes, this is something only I could have produced and...]]> Thu, 16 Jun 2005 12:05:56 -0400 Thu, 16 Jun 2005 12:05:56 -0400 Thu, 16 Jun 2005 12:05:56 -0400 Jun 16, 2005 Radu-Adrian Popescu 0 http://www.theserverside.com/discussions/thread.tss?thread_id=34509

If the document is sent over non-ssl or non-vpn channel, it's vulnerable to man-in-the-middle attack.

Terribly untrue if you use attach a message authentication code to the message.The MAC (say, a HMAC) cannot be...]]> Thu, 16 Jun 2005 11:43:15 -0400 Thu, 16 Jun 2005 11:43:15 -0400 Thu, 16 Jun 2005 11:43:15 -0400 Jun 16, 2005 peter lin 5 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 If the document is sent over non-ssl or non-vpn channel, it's vulnerable to man-in-the-middle attack.

Terribly untrue if you use attach a message authentication code to the message.
The MAC (say, a HMAC) cannot be...]]> Thu, 16 Jun 2005 11:26:05 -0400 Thu, 16 Jun 2005 11:26:05 -0400 Thu, 16 Jun 2005 11:26:05 -0400 Jun 16, 2005 Radu-Adrian Popescu 6 http://www.theserverside.com/discussions/thread.tss?thread_id=34509

If I get a document through insecure channels and then attempt to verify the document is good, it's a false sense of security. I have no gaurantee the document was not altered and rehashed.

No, if document has...]]> Thu, 16 Jun 2005 11:23:09 -0400 Thu, 16 Jun 2005 11:23:09 -0400 Thu, 16 Jun 2005 11:23:09 -0400 Jun 16, 2005 peter lin 0 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 If I get a document through insecure channels and then attempt to verify the document is good, it's a false sense of security. I have no gaurantee the document was not altered and rehashed.

You're right. if the document changes, like a binding contract, it has to be re-signed. But my question is this, "is XML signature is the right solution for this specific problem?" The way legal contracts...]]> Thu, 16 Jun 2005 09:53:35 -0400 Thu, 16 Jun 2005 09:53:35 -0400 Thu, 16 Jun 2005 09:53:35 -0400 Jun 16, 2005 peter lin 9 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 How about some testability? A lot of stuff in the API needs to be retrofitted with interfaces to make them "mockable" using EasyMock, etc.

Sorry to be a nazi, but "etc." indeed. I mock at these mockable...]]> Thu, 16 Jun 2005 03:46:17 -0400 Thu, 16 Jun 2005 03:46:17 -0400 Thu, 16 Jun 2005 03:46:17 -0400 Jun 16, 2005 Radu-Adrian Popescu 0 http://www.theserverside.com/discussions/thread.tss?thread_id=34509

You're right. if the document changes, like a binding contract, it has to be re-signed. But my question is this, "is XML signature is the right solution for this specific problem?" The way legal contracts work, both...]]> Thu, 16 Jun 2005 03:41:19 -0400 Thu, 16 Jun 2005 03:41:19 -0400 Thu, 16 Jun 2005 03:41:19 -0400 Jun 16, 2005 Radu-Adrian Popescu 10 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 there are too many dependencies that could be avoided... if they were not there at all!

Care to mention specific cases where "too many dependencies could be avoided"?

why not getting rid of all the...]]> Wed, 15 Jun 2005 15:54:39 -0400 Wed, 15 Jun 2005 15:54:39 -0400 Wed, 15 Jun 2005 15:54:39 -0400 Jun 15, 2005 javier castanon 0 http://www.theserverside.com/discussions/thread.tss?thread_id=34509
The...]]> Wed, 15 Jun 2005 06:02:45 -0400 Wed, 15 Jun 2005 06:02:45 -0400 Wed, 15 Jun 2005 06:02:45 -0400 Jun 15, 2005 Adam Skogman 1 http://www.theserverside.com/discussions/thread.tss?thread_id=34509 - Remove annotations. This doesn't feel Java'ish. It is making Java...]]> Wed, 15 Jun 2005 03:57:24 -0400 Wed, 15 Jun 2005 03:57:24 -0400 Wed, 15 Jun 2005 03:57:24 -0400 Jun 15, 2005 Jan Hansen 0