> I have not yet managed to fully comprehend the XMLDSIG spec. There
> isn't, by any chance, a way to use XMLDSIG solely for creating and
> transmitting a message digest, without any digital signature?
You can mostly get there; the document hash(es) are separate elements
from the signature. So while it won't be an xmldsig doc, it gets 90%
re-use. In order to do a real hash, you have to do XML canonicalization,
which is a pain. And then you also have to consider how you canonicalize
and hash the attachments.
It ends up being an awful lot of work. Are there any other IETF-spec'd
TCP-based services that do this? SSL/TLS -- so perhaps saying "use ssl
if you're worried about tcp bitrot" is the way to go.
/r$
--
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com
