Signing XML

[Rob Seaman]

Hi Norman,

> Consider this as long-timebase esprit de l'escalier…

There’s some sort of retort needed here involving Led Zeppelin. It will come to me later.

> Way back in 2012 (and I think <http://mail.ivoa.net/pipermail/voevent/2012-September/thread.html> may have been the last gasp) there was discussion of the process and requirements for signing XML VOEvent packets.
> 
> As part of that discussion, I talked of a signing protocol which didn't depend on the famously aggravating complexities of the XML DigSig and Canonicalization recommendations.  It wasn't deemed to be of interest here, but the approach continued to nag and nag at me, and in a couple of bursts of procrastination I finished off Java and C implementations for distribution, and wrote it up for publication.
> 
> See:
> 
>  * blog post: http://text.nxg.me.uk/2015/b65m
>  * preprint: http://arxiv.org/abs/1505.04437 (includes some performance discussion)
>  * code: https://bitbucket.org/nxg/xoxa
> 
> I mention this here really for old times' sake, rather than in the expectation that this is a currently live problem for the group.

Various transient alert issues should soon receive new life. VOEvent is somewhere between the decision and implementation stages in:

	http://en.wikipedia.org/wiki/Diffusion_of_innovations

Practical authentication was recognized early on as a feature that would be required as numbers of time domain surveys and numbers of the resulting alerts and alert streams ramp ever upward.  We are nearing critical mass for the higher order transient alert engineering requirements, and it is good to see that prototype implementations continue to appear.

In addition to possible discussions at the looming IVOA InterOp as John suggests, another time domain forum is now open for business:

	http://timedomainastronomy.net

and this would be a good topic for the IAU working group mailing list:

	https://pairlist10.pair.net/mailman/listinfo/tda_wg

Rob