Continued from page 1
If
recipient does not know
decryption key in advance, then
sender generates and sends it. The key can be protected in transit by encrypting method or key agreement.
If
plaintext data to encrypt is an XML element or content, you encode it using UTF-8 and perform any necessary transforms to it, otherwise, if it is an external resource, you simply consider it as an octet sequence. You then encrypt
data, creating CipherValue, which you place in EncryptedData.
Care must be taken when signing content that may later be encrypted; clearly;
content must be restored to exactly
original plaintext form for
signature to validate properly. To restore
plaintext in
signed content, use
decryption transform method for XML signature defined by
XML encrypt joint W3C and IETF working group.
This transform also allows specifications of XML fragments that were encrypted and then signed with rest of
document and, therefore, are not decrypted to validate
signature. Often, encrypted fragments are removed from
signed information by using
XPATH transform in
reference element, since
meaningful information is
plaintext.
We can sign
plaintext version of an encrypted element by including
appropriate reference element pointing to it. When
signed document is confidential and encrypted after being signed, you should also protect against surreptitious forwarding in which
recipient forwards
signed confidential document to a competitor, encrypted by
competitor public key, trying to make it look as if
sender sent
confidential information. To prevent surreptitious forwarding,
signer should append
recipient identities to
document being signed.

Pawan Bangar, Technical Director, Birbals,India email: www.ebirbals.com www.birbals.com