<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
Mike,</div>
<div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
<br>
</div>
<div><font class="Apple-style-span" face="Calibri,sans-serif">It appears your problem is related to signature verification changes we noticed in the recent java 7u25 update. We observed that by not using a validating parser, id uniqueness could not be guaranteed,
which resulted in </font><span class="Apple-style-span" style="font-family: Calibri, sans-serif; ">signature verification failures for security reasons</span><font class="Apple-style-span" face="Calibri,sans-serif">. Our solution was to bind the <signedMark>
element's id to the validating context, seemingly equivalent to 3) </font><span class="Apple-style-span" style="font-family: Calibri, sans-serif; ">xmlAddID</span><span class="Apple-style-span" style="font-family: Calibri, sans-serif; "> of </span><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; ">section
3.2 of </span><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; "><a href="http://www.aleksey.com/xmlsec/faq.html">http://www.aleksey.com/xmlsec/faq.html</a>.</span></div>
</div>
<div><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; "><br>
</span></div>
<div><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; ">Implementors who are yet to update to the latest java version, or are having trouble doing so, may find the last comment of </span><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; "><a href="http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=8017171">http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=8017171</a></span><span class="Apple-style-span" style="font-size: 14px; font-family: Calibri, sans-serif; "> useful.</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
I too am interested in knowing the libraries used by the TMCH to generate SMD signatures.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
Regards,</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
James Mitchell / Product Owner</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
ARI Registry Services</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px; ">
<br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Mike O'Connell <<a href="mailto:mcanix@gmail.com">mcanix@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, 7 August 2013 10:47 PM<br>
<span style="font-weight:bold">To: </span>Francisco Obispo <<a href="mailto:fobispo@isc.org">fobispo@isc.org</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:tmch-tech@icann.org">tmch-tech@icann.org</a>" <<a href="mailto:tmch-tech@icann.org">tmch-tech@icann.org</a>>, "<a href="mailto:gtld-tech@icann.org">gtld-tech@icann.org</a>" <<a href="mailto:gtld-tech@icann.org">gtld-tech@icann.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [tmch-tech] Test SMDs files now available<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
I'm also using the XMLSec and LibXML2 libraries and I'm just finishing off the verification of SMD signatures.
<div><br>
</div>
<div>Slightly OT but the only issues I've encountered are around the 'id' attribute lacking the prescribed 'xml' prefix, I've had to adjust the invocation to XMLSec to get around the reference errors.
<div><br>
</div>
<div>See section 3.2 of <a href="http://www.aleksey.com/xmlsec/faq.html">http://www.aleksey.com/xmlsec/faq.html</a> and <a href="http://www.w3.org/TR/xml-id/">http://www.w3.org/TR/xml-id/</a> (dated 9 Sept 2005)<br>
<div><br>
</div>
<div>Two questions:</div>
<div><br>
</div>
<div>
<ol class="MailOutline">
<li>Has anyone else encountered this?</li><li>Which libraries is the TMCH using to generate the SMD signatures? </li></ol>
<div><br>
</div>
<div>Kind regards,</div>
<div><br>
</div>
<div>Mike O'Connell</div>
<div><br>
</div>
<div>
<div>--</div>
<div><br>
</div>
<div>If you don't know where you are going, any road will get you there.</div>
</div>
<br>
<div>
<div>On 06 Aug 2013, at 12:34 AM, Francisco Obispo <<a href="mailto:fobispo@isc.org">fobispo@isc.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">I agree,<br>
<br>
I do use XMLSEC and LibXML and have not yet encountered any problems, but I do see it as a source of possible problems, so the least data to be transferred the better.<br>
<br>
<br>
<br>
On Aug 5, 2013, at 1:29 PM, "Gould, James" <<a href="mailto:JGould@verisign.com">JGould@verisign.com</a>> wrote:<br>
<br>
<blockquote type="cite">It's actually a factor of the XML parser and the DSIG software, where based on my experience white space is a factor for validation. Troubleshooting validation issues is not a trivial task. Removing the extra white space and carriage
returns (pretty print) will reduce the size and reduce the risk of validation errors.
<br>
<br>
</blockquote>
<br>
Francisco Obispo <br>
Director of Applications and Services - ISC<br>
email: <a href="mailto:fobispo@isc.org">fobispo@isc.org</a><br>
Phone: +1 650 423 1374 || INOC-DBA *3557* NOC<br>
PGP KeyID = B38DB1BE<br>
<br>
<br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>