Re: EncryptedKeyResolver doesn't allow specifying provider

2009-07-15 Thread Sean Mullan
Please file a bug/rfe at https://issues.apache.org/bugzilla/enter_bug.cgi in the Security project. We need to add a ctor to the EncryptedKeyResolver class that takes an additional provider parameter, and then change XMLCipher to call this new ctor and pass it the provider it is using. Unfort

Re: XMLSignature

2009-07-15 Thread Julien PASQUIER
Hi all, Why is not possible to delete the "final" declaration of the org.apache.xml.security.signature.XMLSignature ? Thanks for your response. Regards, Julien Ernesto Arroyo Ron a écrit : Ah, sometime ago, we tried to implement a XADES class with some special behaviour (mainly to manage b

Re: DO NOT REPLY [Bug 47526] New: XML signature HMAC truncation authentication bypass

2009-07-15 Thread Sean Mullan
1.4.3beta1 binary and source distributions (and ASCII-encoded PGP signatures) are now available at: http://people.apache.org/~mullan/dist/ Signatures can be verified using the Keys in http://santuario.apache.org/dist/KEYS Please let us know ASAP if you find any problems and thanks in advance

Re: XMLSignature

2009-07-15 Thread Sean Mullan
So I went back and checked the source history and it appears that the XMLSignature class used to be non-final way back in 2002. There are no useful comments or bug associated with this change so it appears the rationale for this change has been lost, unless one of the previous active committers

DO NOT REPLY [Bug 47539] New: EncryptedKeyResolver doesn't allow specifying a provider

2009-07-15 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=47539 Summary: EncryptedKeyResolver doesn't allow specifying a provider Product: Security Version: Java 1.4.2 Platform: PC OS/Version: Windows XP Status: NEW