Andreas Neustifter wrote:
Hi List,
I have to provide digital signatures of serialized C++ objects, I'm planing on using Boost::Serialization for the XML part.
Since XML signatures and XMLDsig in particular are difficult [1] and littered with pitfalls I was wondering if maybe the XML output of Boost::Serialization is stable enough to do a plain byte-oriented PKCSwhatever signature?
To summarize:
- C++ objects are serialized to XML with Boost::Serialization (XML is used since date has to be as human readable as possible).
- Serialized XML has to be digitally signed.
- XMLDsig is complicated [1]
Question:
Does Boost::Serialization with the XML backend produce bytewise the same data every time?
This would not and could not be guarenteed across differing library versions and platforms. I would guess that the best way to handle this would be to incorporate XMLDsig compliance into the xml serialization (xml_?archive) itself. I have no doubt what this is a difficult task - but that's why we make the big bucks. Robert Ramey