RE: Reusing XMLSignature for signing and verifying

2009-03-25 Thread Scott Cantor
Sean Mullan wrote on 2009-03-25: > JSR 105 is consistent with your view and documents the behavior. If the > contents of the document are subsequently modified, then you need to > instantiate a new XMLSignature object. Well, in this case, nothing's being modified. What happens is you sign the DOM,

Re: Reusing XMLSignature for signing and verifying

2009-03-25 Thread Sean Mullan
Yeah you may be right, though I don't think the behavior has ever been documented one way or another. Hoping Raul will answer as he is more familiar with that code than I am. JSR 105 is consistent with your view and documents the behavior. If the contents of the document are subsequently modif

RE: Reusing XMLSignature for signing and verifying

2009-03-25 Thread Scott Cantor
Sean Mullan wrote on 2009-03-25: > I don't think the behavior is intentional. Can you please file a bug at > http://issues.apache.org/bugzilla in the security category and attach > your test case? At least dating back to the 1.2 days, it was quite intentional. I found numerous issues with reusing

Re: Reusing XMLSignature for signing and verifying

2009-03-25 Thread Sean Mullan
I don't think the behavior is intentional. Can you please file a bug at http://issues.apache.org/bugzilla in the security category and attach your test case? Thanks, Sean Bruno Harbulot wrote: Hello, I've been writing a test based on OpenSAML, which uses Apache XML Security 1.4.2. In this t