12:40:08 RRSAgent has joined #xmlsec 12:40:08 logging to http://www.w3.org/2007/06/12-xmlsec-irc 12:40:16 klanz2 has joined #xmlsec 12:41:05 Hello, we are starting in 20 mins right ... 12:41:11 yessir 12:42:22 fjh has joined #xmlsec 12:42:54 rdmiller has joined #xmlsec 12:44:54 Zakim, this will be XMLSEC 12:44:54 ok, fjh; I see T&S_XMLSEC()9:00AM scheduled to start in 16 minutes 12:45:17 Meeting: XML Security Specifications Maintenance WG Conference Call 12:45:26 Chair: Frederick Hirsch 12:45:44 Scribe: Donald Eastlake 12:46:16 Agenda: http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0025.html 12:46:32 RRSAgent, make log public 12:49:22 PHB has joined #xmlsec 12:52:08 grw has joined #xmlsec 12:52:18 T&S_XMLSEC()9:00AM has now started 12:52:25 +Frederick_Hirsch 12:53:56 Sean has joined #xmlsec 12:56:04 The power of reference - traffic on my blog up by 2,000 hits in past hour after link from a big blog 12:56:15 who linked to you? 12:56:29 what is the URI for your blog? :) 12:56:29 Talking Points Memo, 12:56:39 http://dotfuturemanifesto.blogspot.com/ 12:57:12 deastl has joined #xmlsec 12:57:24 ScribeNick: deastl 12:58:06 + +aaaa 12:58:32 zakim, call thomas-781 12:58:32 ok, tlr; the call is being made 12:58:33 +Thomas 12:58:54 zakim, aaaa is deastl 12:58:54 +deastl; got it 12:58:56 jcc has joined #xmlsec 12:59:05 zakim, who is on the call? 12:59:05 On the phone I see Frederick_Hirsch, deastl, Thomas 12:59:40 zakim, I am thomas 12:59:40 ok, tlr, I now associate you with Thomas 12:59:45 +grw 13:00:05 +sean 13:01:00 phb, re your blog item: 10 person-years are dirt cheap, you just need to recruit them in the right places, or with the right incentives. 13:01:25 Agenda: http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0025.html 13:01:31 in a TV report about labor in china, the other day, the key quote was: "Oh yes, it's manual labor, otherwise it's not so cheap" 13:01:36 +RobMiller 13:01:41 s/phb, re your blog item: 10 person-years are dirt cheap, you just need to recruit them in the right places, or with the right incentives.// 13:01:46 s/in a TV report about labor in china, the other day, the key quote was: "Oh yes, it's manual labor, otherwise it's not so cheap"// 13:02:18 +Hal_Lockhart 13:02:42 rdmiller says he is not on IRC due to web proxy problems 13:04:00 zakim, who is on the call? 13:04:00 On the phone I see Frederick_Hirsch, deastl, Thomas, grw, sean, RobMiller, Hal_Lockhart 13:04:08 +??P6 13:04:14 zakim, ??P6 is jcc 13:04:14 +jcc; got it 13:04:58 Topic: administrvia 13:05:05 Topic: Administrative 13:05:30 chair: looking for scribes for future calls 13:06:14 chair: request for eview by another W3C group to review material, see link in agenda 13:06:23 008 plenary: http://lists.w3.org/Archives/Member/member-xmlsec-maintwg/2007Jun/0014.html 13:06:30 s/00/200 13:06:38 +PHB 13:06:41 hal has joined #xmlsec 13:06:53 pls review widget signing http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0017.html 13:06:57 chair: Hal ageed to scribe on the 26th, still look for scribe to the 19th 13:07:04 Topic: minutes from last time 13:07:22 Chair: any comments? 13:07:33 http://www.w3.org/2007/06/05-xmlsec-minutes.html 13:07:37 Chair: none, minutes approved 13:07:40 yep 13:07:46 zakim, who is muted? 13:07:46 I see no one muted 13:07:50 zakim, mute me 13:07:50 Thomas should now be muted 13:07:56 Topic: review of actions 13:07:59 zakim, unmute me 13:07:59 Thomas should no longer be muted 13:08:07 ACTION-26 continued 13:08:11 chair: Action 26 - open 13:08:20 chair: action 35 open 13:08:44 ACTION-36 continued 13:08:45 chair" action 36 to be reviewed by Juan Carlos - open 13:08:50 s/chair"/chair:/ 13:09:00 chair: action 37: to be revied by shaun open 13:09:23 chair: 41 review implementation, not captured in previous minutes, closed 13:09:41 chair: 42 Juan Crlos producing an example. done, 13:09:49 calling in 13:09:56 konrad is not yet on the phone? 13:10:03 finished, mail to the list first 13:10:07 chair: 43 Conrad to produce examples, done?? 13:10:12 zakim, who is on the call? 13:10:12 On the phone I see Frederick_Hirsch, deastl, Thomas, grw, sean, RobMiller, Hal_Lockhart, jcc, PHB 13:10:18 konrad, how about joining? 13:10:28 chair: leave 43 open to be conservative 13:10:33 chair: 44 closed, update the draft 13:10:53 http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0031.html 13:11:01 chair: 45, done 13:11:07 chair: 46, done 13:11:43 chair: 47, decryption update draft, done 13:11:47 +??P8 13:11:50 -grw 13:12:05 zakim, ??P8 is konrad 13:12:05 +konrad; got it 13:12:08 -konrad 13:12:12 chair: 48, proposal to resolve issue 13:12:14 got kicked out 13:12:21 jcc: 48 still open 13:12:31 +grw 13:13:17 tlr: Action 39 shows open, would like to close it as done 13:13:24 chair: OK, close 39 13:13:46 chair: if/when Konrad come back talk about 49, 43 13:13:51 Topic: workshop 13:14:12 chair: Have revised CFP. Ready for release? 13:14:23 +??P8 13:14:26 tlr: Have already submittted to W3C mgmt for approval 13:14:30 chair: what next 13:14:32 zakim, ??P8 is klanz2 13:14:32 +klanz2; got it 13:14:35 zakim, +??P8 is klanz2 13:14:35 sorry, klanz2, I do not recognize a party named '+??P8' 13:14:47 tlr: next, have set up mailing list to receive position papers 13:14:55 zakim, ? is klanz2 13:14:55 sorry, klanz2, I do not recognize a party named '?' 13:15:05 tlr: hope can announce tomorrow morning so we can start recruiting 13:15:20 zakim, klanz2 is +??P8 13:15:20 ++??P8; got it 13:15:21 tlr: then get nervous because people ususally submit at deadline 13:15:44 chiar: sticking with 25/26 September dates, hosted at Verisgin? 13:15:51 tlr: Yes, hosting confirmed. 13:16:16 chair: didn't change due to short timeline, etc. 13:16:25 zakim, who is on the phone? 13:16:25 On the phone I see Frederick_Hirsch, deastl, Thomas, sean, RobMiller, Hal_Lockhart, jcc, PHB, grw, +??P8 13:16:32 chair: Phil, give him action to create logistics page? 13:16:57 sorry, got asked question 13:17:24 tlr: will need logistics page with hotels, etc. Generally detailed logistics page only available to registrants 13:17:50 tlr: happy to make an Action or just trust PHB to handle it 13:18:07 ACTION: phb to create workshop logistics page 13:18:07 Created ACTION-50 - Create workshop logistics page [on Phillip Hallam-Baker - due 2007-06-19]. 13:18:12 tlr: By mid- 13:18:22 tlr: by mi-July is fine 13:18:47 tlr: Critical for people to do outreach of CFP 13:19:03 Topic: action items (2) 13:19:16 chair: Konrad, status of Action 43? 13:19:36 Konrad: should be closed. Original breakage example has been clarified 13:19:43 ACTION-43 closed 13:19:43 Sorry... I don't know how to close ACTION yet 13:20:03 Konrad: discharged on original brakage issue 13:20:20 chair: Action 49 Konrad? 13:20:33 Konrad: That one is also completed. Examples sent to list today. 13:20:42 ACTION-49 closed 13:20:42 Sorry... I don't know how to close ACTION yet 13:20:43 http://www.w3.org/mid/466E7D31.20700@iaik.tugraz.at 13:20:54 Action-49:http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0028.html 13:21:05 Action-49: "http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0028.html" 13:21:13 chair: action items and workshop review completed 13:21:20 Topic: Decyrption transforms 13:21:36 Action-43: http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0027.html 13:21:44 chair: Have fixed for canonicalization 1.1, next step move to public review 13:21:46 s/Decyprtion/Decryption/ 13:21:57 chair: don't think people have looked at it, no reason not to give people another week to review 13:22:15 chair: OK, that plan accepted 13:22:40 Topic: Distinguished Names 13:23:14 "compliant with RFC2253" or "compliant with the DNAME processing rules at end of section" 13:23:25 chair: We change the bullet list (agenda 6a) ...current editor's draft incorrect 13:23:26 http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0016.html 13:23:38 current proposal: http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0004.htm 13:23:46 ##1## 13:23:51 chair: Konrad has put a proposal on the list which restored bullet items 13:24:10 chair: do we want to make this change? What we have no is not quite right 13:24:44 chair: Are we ok with Konrad's change? Should we post it to chat? 13:25:15 ##1## 13:25:15 As I wrote in [4] already 13:25:15 The text says: 13:25:15 "At least one element, from the following ... " 13:25:15 So the bullet points will still have to enumerate the the choice of 13:25:16 elements within the content of |X509Data| which is not the case in the 13:25:18 current red line document ... and will need to be changed to something like the following: 13:25:20 [4]: 13:25:22 > * The |X509IssuerSerial| element, which contains an X.509 13:25:24 > issuer distinguished name/serial number pair. The distinguished 13:25:26 > name SHOULD be compliant with the DNAME 13:25:28 > encoding rules at the end of this section and the serial 13:25:30 > number is represented as a decimal integer, 13:25:32 > * The |X509SubjectName| element, which contains an X.509 13:25:34 > subject distinguished name that SHOULD be compliant with the 13:25:36 > DNAME encoding rules at the end of this section, 13:25:38 [4] 13:25:40 http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0004.html 13:25:40 q+ 13:26:08 ack jcc 13:26:21 http://lists.w3.org/Archives/Public/public-xmlsec-maintwg/2007Jun/0020.html 13:26:28 jcc: I send some comments a few days ago 13:26:49 jcc: First bullet is OK 13:26:50 The 13:26:50 >> distinguished 13:26:50 >> name SHOULD be compliant with the DNAME 13:26:50 >> encoding rules at the end of this section and the serial 13:26:50 >> number is represented as a decimal integer, 13:27:25 jcc: "and number is reperested by a decimal integer" is not necssary as schema says that 13:27:29 I'm not strong about this ... 13:28:10 q+ 13:28:20 ack klanz 13:28:49 q+ 13:28:50 Konrad: Don't see harm in having this in both the text and schema 13:29:02 tlr: we are dealing with Erratum 1 13:29:26 E01 2002-01-28 (Editorial): 13:29:35 N.B.: the bullet points will still have to enumerate the the choice of 13:29:35 elements within the content of |X509Data| 13:29:40 http://www.w3.org/2001/10/xmldsig-errata#E01 13:29:48 tlr: DNAME rules, which take precidence, are subtly different from RFC 2253... what does this have to do with schema values? 13:30:42 chair: are we going beyond the Errata 13:31:04 chair: any other opinions, would like to resolve 13:31:29 I agree with jcc, no need to mention serial number in first bullet. 13:31:59 -PHB 13:32:00 chair: maybe way forward is to remove that 13:32:01 s/and the serial number is represented as a decimal integer// 13:32:11 tlr: can Konrad type updated text 13:32:44 [4]: 13:32:44 > * The |X509IssuerSerial| element, which contains an X.509 13:32:44 > issuer distinguished name/serial number pair. The distinguished 13:32:44 > name SHOULD be compliant with the DNAME 13:32:44 > encoding rules at the end of this section, 13:32:45 > * The |X509SubjectName| element, which contains an X.509 13:32:47 > subject distinguished name that SHOULD be compliant with the 13:32:49 > DNAME encoding rules at the end of this section, 13:33:00 chair: proposal becomes what the Errata tried to say originally 13:33:32 Konrad: No, actually we removed the first two bullet points and merged.. 13:33:53 fjh: reads awkwardly 13:34:14 chair: OK with approving 13:34:23 +1 to fjh 13:34:46 +1 13:34:54 +PHB 13:34:57 +jcc 13:35:02 chair: OK, get red line fixed and then consider approving whole section 13:35:04 phill, did the connection drop suddenly? 13:35:21 chair: any objection to tentative approve understanding we will re-reveiw whole section 13:35:43 No, I just moved to my upstairs office 13:35:54 (no ojbections) 13:36:06 ah, good 13:36:16 RESOLUTION: Adopt change as noted above to 4.4.4 first 2 bullets, then review 4.4.4 as a whole later 13:36:49 ##2## 13:36:49 I also believe we agree on the following mentioned in [5] about the 13:36:49 DNAME escaping rules at the end of the section: 13:36:49 > I would assume that leading spaces have been forgotten to be mentioned 13:36:49 > in the first sub point of the second bullet point. 13:36:50 RRSAgent, where am I? 13:36:50 See http://www.w3.org/2007/06/12-xmlsec-irc#T13-36-50 13:36:50 > This position is also supported by the examples given in 13:36:52 > http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2002JanMar/0246.html . 13:37:14 p 13:37:18 original was: 13:37:20 "Also, strings in DNames (X509IssuerSerial,X509SubjectName, and 13:37:29 KeyName if approriate) should be encoded as follows:" 13:37:33 now in red-line: 13:37:40 "DNames (X509IssuerSerial, X509SubjectName, and KeyName if 13:37:49 appropriate) should be encoded in accordance with RFC2253 [LDAP-DN] 13:37:57 except for the encoding of string values within a DName:" 13:38:33 Topic: Optionality of DNAME encoding rules 13:38:48 chair: Konrad said it should be optional 13:39:03 chair: Do we agree, should we captialize SHOULD? 13:40:13 konrad: I had a closer look at postings to list of test cases. Speaks about DNAME encloding rules in such a way to imply it should be optional 13:40:27 deastl: I don't remember 13:40:39 some evidence: 13:40:39 [2] says: "The following example set contains test vectors for the 13:40:39 OPTIONAL DNAME encoding" 13:40:39 [3] says: " 13:40:39 * The |X509IssuerSerial| element, which contains an X.509 issuer 13:40:40 distinguished name/serial number pair that SHOULD be compliant 13:40:42 with RFC2253 [LDAP-DN 13:40:44 ], 13:40:46 * The |X509SubjectName| element, which contains an X.509 subject 13:40:48 distinguished name that SHOULD be compliant with RFC2253 [LDAP-DN 13:40:50 ], 13:40:53 " 13:40:54 [3] only says: "... should be encoded ... " where should is written in 13:40:56 small capitalization to the additional rules 13:40:56 chair: what does optionality mean for interoperability...? 13:40:58 I hence conclude the only normative statement in the original text is 13:41:00 that "distinguished names SHOULD be compliant with RFC2253". 13:41:02 [2] http://www.w3.org/Signature/2001/04/05-xmldsig-interop.html#DNAME 13:41:04 [3] http://www.w3.org/TR/xmldsig-core/#sec-X509Data 13:41:22 q+ 13:41:30 ack sean 13:41:30 +1 to sean 13:41:41 ack Thomas 13:41:43 should stry to stay within RFC 2253 13:42:22 Greg: doesn't seem like we can make a statement any stronger than should 13:42:32 greg: cannot go beyond SHOULD with errata 13:42:38 r: mistake is about not escaping leading white space? 13:42:48 right 13:43:12 tlr: RFC 2253 says deal with UTF-8 by escaping some characters with backslash 13:43:26 q+ 13:43:51 tlr: is an implementation that uses \20 for space compliant or marginal? 13:44:10 tlr: probably any reasonable implementation will understandt \20 13:44:21 ack klanz 13:44:50 Konrad: RFC 2253 only talks about he first and last white space if any in a string, interior space can be escaped as \20 13:45:08 Konrad: some implementations might work but, strictly speaking, it does not comply 13:45:30 chair: Do we agree that we can't go beyond "should" because we are doing Errata 13:46:30 Additionally some text like the following might do the trick for support 13:46:30 legacy signatures: 13:46:30 > For legacy support please note, that applications receiving signatures containing DNAMES having AttributeValues terminated by "\20" 13:46:30 > are RECOMMENDED to treat an "\20" escaped character at the end of an AttributeValue as if they were normal escaped space characters "\ " conformant to section 2.4 of RFC 2253. Do not convert "\20" to "\ " if the DNAME in question is signed. 13:47:05 Is it fair to current implementations to change the rules, even to a should 13:47:22 q+ 13:47:45 ack Thomas 13:47:47 q+ 13:48:27 tlr: This is murky territory. Dealing with RFC 2253 which isn't that clear and interacting with other specs... 13:48:47 -1 to tlr 13:49:14 tlr: suggest sticking to current Errata. Before resolving this Errata, someone whould construct a number of simple test cases and try them on existing implementations. 13:49:35 q+ 13:49:37 tlr: The best we can do is to try to figure out how people have interpreeted the spec 13:50:18 tlr: Have specific rule on the leading/traing white space seems too deep in details... 13:50:18 ack klanz 13:50:42 Konrad: I disagree. We can do it better and be backward compatible. Collateral damage will be essentially null. 13:51:12 ack fjh 13:51:13 Konrad: leading/traiing white space should almost never occur in certificates... but should allow old practice 13:51:47 fjh: heard two things: red-line has change based on Errata, uses lower case should. That does not seem controversial. 13:51:50 q+ 13:52:05 fjh: But Konrad is suggesting enhacing with further text. Is that right? 13:52:06 ack thomas 13:52:43 q+ 13:52:47 tlr: the one normativity change we are making is to item 1 where we are saying "SHOULD" be compatible to DNAME encoding rules 13:52:58 tlr: No longer making only informational change 13:53:06 ack klanz 13:53:41 Konrad: we are fixing an internal contradicition. It used to say should follow RFC 2253 but then gave slightly different rules... 13:54:40 tlr: Can read RFC 2253 to give format and rules for generating that format. Rules are partially optional. 13:55:26 tlr: xmlsig rules can be interpreted in a way consisten with normative rules in RFC 2253 in such a way as to be not contradictory 13:55:56 tlr: Disagree with Konrad's statement that there is a contradiction 13:56:16 Konrad: can give contractory examples 13:56:24 tlr:Not clear to me... 13:57:04 chair: need action(s) to clear this up. tlr has mentioned examples. 13:57:15 tlr: missing converting back rules 13:57:37 q+ 13:57:50 chair: tlr, can you put stuff on list to explain 13:58:03 chair: can anyone else on call help? 13:58:27 chair: we need more infor. Can't go forward otherwise 13:58:54 chair: Best thing for Thomas to put a message on the list... 13:59:22 chiar: People on call should look at agenda, at other DNAME items, so we can get it right for the next call 13:59:39 chair: anything we can do on the list would help 13:59:41 s/chiar/chair/ 14:00:06 chair: I'll try to speed up the Action item portion of calls. 14:00:24 chair: anyting else for remaining minute of call? 14:00:40 chair: Konrad, tlr, ..., any furhter suggestion for how to make progress? 14:01:58 Konrad:The suggestion should affect only future coreated signtures, like the changes we made re Canonicalization 1.1... 14:02:14 I 'll have to go now 14:02:35 +1 to tlr 14:02:45 I'll be on the list 14:02:53 tlr: One more thing: dealing with references to an obsoleded RFC. I'm checking the new replacemented to see if it is relevant. 14:03:15 ACTION: tlr to see if RFC4514 is consistent with dsig encoding rules 14:03:15 Created ACTION-51 - See if RFC4514 is consistent with dsig encoding rules [on Thomas Roessler - due 2007-06-19]. 14:03:24 and, indeed, it is! 14:03:35 -Hal_Lockhart 14:03:36 chair: ajourn 14:03:36 -grw 14:03:37 -PHB 14:03:39 -Thomas 14:03:41 -Frederick_Hirsch 14:03:43 -sean 14:03:45 -RobMiller 14:03:49 - +??P8 14:03:51 -jcc 14:03:53 -deastl 14:03:56 T&S_XMLSEC()9:00AM has ended 14:03:57 Attendees were Frederick_Hirsch, +aaaa, Thomas, deastl, grw, sean, RobMiller, Hal_Lockhart, jcc, PHB, konrad, +??P8 14:06:21 Thank you Donald for scribing. 14:06:44 rrsagent, please draft minutes 14:06:44 I have made the request to generate http://www.w3.org/2007/06/12-xmlsec-minutes.html tlr 14:06:50 rrsagent, please make this record public 16:25:43 Zakim has left #xmlsec 17:48:04 PHB has left #xmlsec