XML Signature Wrapping Still Considered Harmful: A Case Study on the Personal Health Record in Germany
Cryptography and Security
2021-06-22 v1
Abstract
XML Signature Wrapping (XSW) has been a relevant threat to web services for 15 years until today. Using the Personal Health Record (PHR), which is currently under development in Germany, we investigate a current SOAP-based web services system as a case study. In doing so, we highlight several deficiencies in defending against XSW. Using this real-world contemporary example as motivation, we introduce a guideline for more secure XML signature processing that provides practitioners with easier access to the effective countermeasures identified in the current state of research.
Keywords
Cite
@article{arxiv.2106.10460,
title = {XML Signature Wrapping Still Considered Harmful: A Case Study on the Personal Health Record in Germany},
author = {Paul Höller and Alexander Krumeich and Luigi Lo Iacono},
journal= {arXiv preprint arXiv:2106.10460},
year = {2021}
}
Comments
Accepted for IFIP SEC 2021