selected subtrees with the filter node-set. In this case, the filter
node-set initially contains the entire input document, and the XPath
expression evaluates to the two ToBeSigned elements; these are
expanded to include all their descendents and intersected with the
filter node-set, resulting in the following:
<ToBeSigned>
<!-- comment -->
<Data />
<NotToBeSigned>
<ReallyToBeSigned>
<!-- comment -->
<Data />
</ReallyToBeSigned>
</NotToBeSigned>
</ToBeSigned><ToBeSigned>
<Data />
<NotToBeSigned>
<Data />
</NotToBeSigned>
</ToBeSigned>
The subtract filter computes the subtraction of the XPath-selected
subtrees from the filter node-set. In this case, the XPath
expression evaluates to the two NotToBeSigned elements; these are
expanded to include all their descendents and subtracted from the
filter node-set:
<ToBeSigned>
<!-- comment -->
<Data />
</ToBeSigned><ToBeSigned>
<Data />
</ToBeSigned>
Next, the union filter computes the union of the XPath-selected
subtrees with the filter node-set. In this case, the XPath
expression evaluates to the ReallyToBeSigned element; this is
expanded to include all its descendents and added to the filter
node-set:
<ToBeSigned>
<!-- comment -->
<Data />
<ReallyToBeSigned>
<!-- comment -->
<Data />
</ReallyToBeSigned>
</ToBeSigned><ToBeSigned>
<Data />
</ToBeSigned>
Finally, this resulting filter node-set is used to transform the
input node-set. In this example, the input node-set is the entire
document, with comments removed. The transformed node-set will thus
be all those nodes from the input document, less comments, that are
also in the filter node-set:
<ToBeSigned>
<Data />
<ReallyToBeSigned>
<Data />
</ReallyToBeSigned>
</ToBeSigned><ToBeSigned>
<Data />
</ToBeSigned>
Note that the result contains no nodes that were not in the input
node-set. Although the filter node-set included comments, these were
not present in the input node-set so they are not present in the
output node-set.
This signature filter does not provide any increased capability over
the original XPath transform. For example, this reference could be
replicated using the XPath transform as follows.
<dsig:Reference URI="">
<dsig:Transforms>
<dsig:Transform
Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
<dsig:XPath>
(ancestor-or-self::ToBeSigned and
not (ancestor-or-self::NotToBeSigned))
or ancestor-or-self::ReallyToBeSigned
</dsig:XPath>
</dsig:Transform>
</dsig:Transforms>
... </dsig:Reference>
The advantage of the signature filter transform over the XPath
transform is that the latter requires evaluation of a potentially-
complex expression against every node in the input set, which has
proved costly in practice for many useful operations. This
specification’s filter requires evaluation of simple XPath
expressions and then the execution of some basic set operations or
their equivalent, which can be implemented significantly more
efficiently.
5. Normative References
[Keywords] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[URI] Berners-Lee, T., Fielding, R. and L. Masinter, "Uniform
Resource Identifiers (URI): Generic Syntax", RFC 2396,
August 1998.
[XML] "Extensible Markup Language (XML) 1.0 (Second Edition)",
T. Bray, E. Maler, J. Paoli, and C. M. Sperberg-
McQueen. W3C Recommendation, October 2000. Available at
<http://www.w3.org/TR/2000/REC-xml-20001006>.
[XML-C14N] Boyer, J., "Canonical XML", RFC 3076, March 2001. Also a
W3C Recommendation available at
<http://www.w3.org/TR/2001/REC-xml-c14n-20010315>.
[XML-DSig] Eastlake, J., Reagle, J. and D. Solo, "XML-Signature
Syntax and Processing", RFC 3275, March 2002. Also a W3C
Recommendation available at
<http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/>.
[XML-NS] "Namespaces in XML", T. Bray, D. Hollander, and A.
Layman. W3C Recommendation, January 1999. Available at
<http://www.w3.org/TR/1999/REC-xml-names-19990114/>.
[XPath] "XML Path Language (XPath) Version 1.0", J. Clark and S.
DeRose. W3C Recommendation, November 1999. Available at
<http://www.w3.org/TR/1999/REC-xpath-19991116>. (Note
also XPath Errata at <http://www.w3.org/1999/11/REC-
xpath-19991116-errata>.)
[XPointer] "XML Pointer Language (XPointer)", S. DeRose, R. Daniel,
and E. Maler. W3C Candidate Recommendation, January
2001. Available at <http://www.w3.org/TR/2001/CR-xptr-
20010911/>.
6. Authors’ Addresses
John Boyer
PureEdge Solutions Inc.
4396 West Saanich Rd.
Victoria, BC, Canada V8Z 3E9
Phone: +1-888-517-2675
EMail: jboyer@PureEdge.com
Merlin Hughes
Betrusted, Inc.
11000 Broken Land Parkway Suite 900
Columbia, MD 21044
Phone: +1-443-367-7000
EMail: Merlin.Hughes@betrusted.com
Joseph M. Reagle Jr., W3C
Massachusetts Institute of Technology
Laboratory for Computer Science
NE43-350, 545 Technology Square
Cambridge, MA 02139
Phone: +1.617.258.7621
EMail: reagle@mit.edu
7. Full Copyright Statement
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assignees.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.