Hacker News Reader

I think I got to the canonicalization part of the relevant spec and decided that life was too short...

NB I can absolutely see why canonicalization is required... just that it was the bit where I lost interest

The first book that came out on XMLDSig, "Secure XML: The New Syntax for Signatures and Encryption", written by the chair of the working group, spent over half of its 500 pages wrestling with canonicalization, and even then it read more as a 250-page problem statement than a solution.

And that was before you got into deliberately malicious content that actively subverts the signature process.

Reply on news.ycombinator.com