XML signature element wrapping attacks and countermeasures

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2005, Pages 20-27

  McIntosh, Michael ^a   Austel, Paula ^a  

^a IBM RESEARCH   (United States)

Author keywords

And Countermeasure; Attack; Security Policy; Vulnerability; Web Services Security; XML Signature

Indexed keywords

SECURITY EXPERTS; SECURITY POLICY; SOAP MESSAGES; WEB SERVICES SECURITY; XML SIGNATURE;

MARKUP LANGUAGES; SECURITY SYSTEMS; WEB SERVICES; XML;

SECURITY OF DATA;

EID: 77954328275     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1103022.1103026     Document Type: Conference Paper

References (14)

1. Eastlake, D., Reagle, J., Solo, D. (editors): XML-Signature Syntax and Processing: W3C Recommendation: 12 February 2002 http://www.w3.org/TR/2002/REC- xmldsig-core-20020212/)
2. Box, D., Ehnebuske, D., Kakivaya, G., Layman, A., Mendelsohn, N., Nielsen, H. F., Thatte, S., Winer, D.: Simple Object Access Protocol (SOAP) 1.1: W3C Note: 08 May 2000: http://www.w3.org/TR/2000/NOTE-SOAP-20000508)
3. Mitra, N. (editor): SOAP Version 1.2 Part 0: Primer: W3C Recommendation: 24 June 2003: http://www.w3.org/TR/2003/REC-soap12-part0-20030624/)
4. Gudgin, M., Hadley, M., Mendelsohn, N., Moreau, J., Nielsen, H. F (editors): SOAP Version 1.2 Part 1: Messaging Framework: W3C Recommendation 24 June 2003: http://www.w3.org/TR/2003/REC-soap12-part1-20030624/)
5. Gudgin, M., Hadley, M., Mendelsohn, N., Moreau, J., Nielsen, H. F. (editors): SOAP Version 1.2 Part 2: Adjuncts: W3C Recommendation: 24 June 2003: http://www.w3.org/TR/2003/REC-soap12-part2-20030624/)
6. Nadalin, A., Kaler, C., Hallam-Baker, P., Monzillo, R. (editors) Web Services Security: SOAP Message Security 1.0 (WS-Security 2004): OASIS Standard 200401, March 2004 http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap- message-security-L0.pdf)
7. Mcintosh, M. "New Issue (w/Proposal): Signing the Signer's Security Token": Online Posting: 23 September 2004: WS-I Basic Security Profile Working Group http://members.wsi.org/Resource.phx/lyris/newmessage.htx?id=64333)
8. Mcintosh, M. "Re: [wsi-wsbasic-apps] question from sample apps group on C5440": Online Posting: 23 September 2004: WS-I Basic Security Profile Working Group http://members.wsi.org/Resource.phx/lyris/newmessage.htx?id=64445)
9. Mcintosh, M. "Re: [wsi-wsbasic-apps] question from sample apps group on C5440": Online Posting: 24 September 2004: WS-I Basic Security Profile Working Group http://members.wsi.org/Resource.phx/lyris/newmessage.htx?id=64673)
10. Bray, T., Paoli, J., Sperberg-McQueen, C. M., Maler, E., Yergeau, F. (editors): Extensible Markup Language (XML) 1.0 (Third Edition): W3C Recommendation: 04 February 2004 http://www.w3.org/TR/2004/REC-xml-20040204)
11. Grosso, P., Maler, E., Marsh, J., Walsh, N. (editors): XPointer Framework: W3C Recommendation: 25 March 2003: http://www.w3.org/TR/2003/REC- xptr-framework-20030325/)
12. Kaler, C., Nadalin, A. (editors): Web Services Security Policy Language (WS-SecurityPolicy) Version 1.1: July 2005: ftp://www6.software.ibm.com/ software/developer/library/wssecpol.pdf)
13. Clark, J., DeRose, S. (editors): XML Path Language (XPath) Version 1.0: W3C Recommendation 16 November 1999: http://www.w3.org/TR/1999/REC-xpath- 19991116)
14. Fournet, C. "Formal Tools for Web Services Security": 5-6 May 2005: DIMACS Workshop http://dimacs.rutgers.edu/Workshops/Commerce/slides/ fournet.ppt)