Content extraction signatures using XML digital signatures and custom transforms on-demand

ABSTRACT

Content Extraction Signatures (CES) enable selective disclosure of verifiable content, provide privacy for blinded content, and enable the signer to specify the content the document owner is allowed to extract or blind. Combined, these properties give what we call CES functionality. In this paper we describe our work in developing custom transform algorithms to expand the functionality of an XML Signature to include CES functionality in XML Signature Core Validation.We also describe a custom revocation mechanism and our implementation for non-XML content where the custom transforms are dynamically loaded demonstrating that custom signing and verification is not constrained to a 'closed system'. Through the use of dynamic loading we show that a verifier can still verify an XML Signature-compliant signature even though a custom signature was produced.

REFERENCES

• 1: B. Atkinson, G. Della-Libera, S. Hada, M. Hondo, P. Hallam-Baker, J. Klein, B. LaMacchia, P. Leach, J. Manferdelli, H. Maruyama, A. Nadalin, N. Nagaratnam, H. Prafullchandra, J. Shewchuk, and D. Simon. Web services security (WS-Security), In C. Kaler, editor, Version 1.0. April 05 2002. {Last accessed: February 24, 2003}, http://www-106.ibm.com/developerworks/library/ws-secure/
• 2: M. Bartel, J. Boyer, B. Fox, B. LaMacchia, and E. Simon. XML-signature syntax and processing, In D. Eastlake, J. Reagle, and D. Solo, editors, W3C Recommendation. Feb. 12 2002. {Last accessed: September 18, 2002}, http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/
• 3: Mihir Bellare , Gregory Neven, Transitive Signatures Based on Factoring and RSA, Proceedings of the 8th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology, p.397-414, December 01-05, 2002
• 4: T. Berners-Lee, R. Fielding, and L. Masinter. RFC 2396. uniform resource identifiers (URI): Generic syntax, Available online, August 1998. {Last accessed: September 25, 2002}, http://www.ietf.org/rfc/rfc2396.txt
• 5: D. Box, D. Ehnebuske, G. Kakivaya, A. Layman, N. Mendelsohn, H. Nielsen, S. Thatte, and D. Winer. Simple Object Access Protocol {(SOAP)} 1.1, W3C note 8 May, 2002 edition, 2002. {Last accessed: November 15, 2002}, http://www.w3.org/TR/2000/NOTE-SOAP-20000508
• 6: J. Boyer, D. Eastlake, and J. Reagle. Exclusive XML Canonicalization, W3C Recommendation 18 July, 2002 edition, 2002. {Last accessed: July 12, 2002}, http://www.w3.org/TR/2002/REC-xml-exc-c14n-20020718/
• 7: J. Boyer, M. Hughes, and J. Reagle. XML-Signature XPath Filter 2.0, W3C Recommendation 08 November, 2002 edition, 2002. {Last accessed: November 12, 2002}, http://www.w3.org/TR/2002/REC-xmldsig-filter2-20021108/
• 8: Stefan A. Brands, Rethinking Public Key Infrastructures and Digital Certificates: Building in Privacy, MIT Press, Cambridge, MA, 2000
• 9: S. Brands. A technical overview of digital credentials, Available online, Feb. 20 2002. {Last accessed: February 18, 2003}, http://www.xs4all.nl/~brands/overview.pdf
• 10: L. Bull, J. Newmarch, and Y. Zheng. Enhancing privacy through selective disclosure of verifiable content or the facts, the whole facts, and nothing but the facts. Technical Report 2002/123, School of Computer Science and Software Engineering, Monash University, 900 Dandenong Road, Caulfield East, Victoria 3145 Australia, October 2002.
• 11: P. Devanbu , M. Gertz , A. Kwong , C. Martel , G. Nuckolls , S. G. Stubblebine, Flexible authentication of XML documents, Proceedings of the 8th ACM conference on Computer and Communications Security, November 05-08, 2001, Philadelphia, PA, USA [doi>10.1145/501983.502003]
• 12: N. Freed and N. Borenstein. Multipurpose Internet mail extensions (MIME) part one: Format of Internet message bodies, Available online, August 1996. {Last accessed: October 16, 2002}, http://www.ietf.org/rfc/rfc2045.txt
• 13: A. Freier, P. Karlton, and P. Kocher. The SSL protocol version 3.0, Available online, 1996. {Last accessed: September 18, 2002}, http://wp.netscape.com/eng/ssl3/draft302.txt
• 14: Robert Johnson , David Molnar , Dawn Xiaodong Song , David Wagner, Homomorphic Signature Schemes, Proceedings of the The Cryptographer's Track at the RSA Conference on Topics in Cryptology, p.244-262, February 18-22, 2002
• 15: .NET framework security, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 2002
• 16: Silvio Micali , Ronald L. Rivest, Transitive Signature Schemes, Proceedings of the The Cryptographer's Track at the RSA Conference on Topics in Cryptology, p.236-243, February 18-22, 2002
• 17: Hilarie K. Orman, Data Integrity for Mildly Active Content, Proceedings of the Third Annual International Workshop on Active Middleware Services, p.73, August 06-06, 2001
• 18: R. Rivest. Two signature schemes, Available online, October 2000. Slides from talk given at Cambridge University. {Last accessed: February 19, 2003}, http://theory.lcs.mit.edu/~rivest/publications.html
• 19: D. Sax. DNS spoofing (malicious cache poisoning), Available online, November 12 2000. {Last accessed: February 25, 2003}, http://www.sans.org/rr/firewall/DNS_spoof.php
• 20: Ron Steinfeld , Laurence Bull , Yuliang Zheng, Content Extraction Signatures, Proceedings of the 4th International Conference Seoul on Information Security and Cryptology, p.285-304, December 06-07, 2001

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce

General Terms:
Security

Keywords:
.Net framework XML signature API, XML signature custom transforms, XML signatures, content extraction signatures, dynamic signature verification