I think that's the core question: does the Visa spec call for handling their CDATA "id" attribute as if it were an ID? I don't know anything about the spec, except that it causes this question to arise periodically (occasionally inducing me to rant). Slava, can you point to it, or excerpt relevant sections?
It doesn't matter; if they are using "URI=#..." in the Reference, then it must be an ID or they are not compliant with the DSIG spec.
/r$
--
Rich Salz, Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
_______________________________________________ xmlsec mailing list [EMAIL PROTECTED] http://www.aleksey.com/mailman/listinfo/xmlsec
