HackerPapers

arXiv:2106.10460cs.CR

XML Signature Wrapping Still Considered Harmful: A Case Study on the Personal Health Record in Germany

Paul Höller, Alexander Krumeich, Luigi Lo Iacono

Early discovery. Linked by one identifiable commenter. This paper is outside the main ranking; a mention is not an endorsement.

Abstract

XML Signature Wrapping (XSW) has been a relevant threat to web services for 15 years until today. Using the Personal Health Record (PHR), which is currently under development in Germany, we investigate a current SOAP-based web services system as a case study. In doing so, we highlight several deficiencies in defending against XSW. Using this real-world contemporary example as motivation, we introduce a guideline for more secure XML signature processing that provides practitioners with easier access to the effective countermeasures identified in the current state of research.

arXiv comments
Accepted for IFIP SEC 2021
Journal reference
ICT Systems Security and Privacy Protection, 2021, p. 3-18
DOI
doi:10.1007/978-3-030-78120-01
Subjects
cs.CRCryptography and Security

On Hacker News

Linked by 1 identifiable commenter in 1 comment across 1 thread, from Jul 2024 to Jul 2024.

Comments linking this paper, per year.

Discussed in comments1 thread

  1. A Gentle Introduction to SAML 1 comment

    • In addition to reasons shared by other commenters, my main concern is XML Signature Wrapping. XMLDSig APIs are not well designed. They check whether signatures in a document are valid, but signatures are not required to cover the entire document. XMLDSig APIs do not make it easy…

      mdavidnView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.