TMSAD describes a common trust model that can be applied to specifications within the security automation domain, such as Security Content Automation Protocol (SCAP). Since information in the security automation domain is primarily exchanged using Extensible Markup Language (XML), the focus of this model is on the processing of XML documents. The trust model is composed of recommendations on how to use existing specifications to represent signatures, hashes, key information, and identity information in the context of an XML document within the security automation domain.
It's weird that we don't sign our content or validate signed content as it's a best security practice to provide signed content. We should do this for non-tailored content; although, an option to resign with a different signature would be great to. Obviously any content with invalid signatures should fail to run.
1684 together with #1719 should solve the first part of the problem, validation of the input. Signature validation is a part of SCAP1.3. However, it does not require the scanner to sign the resulting documents.
evgenyz
commented
3 years ago
TMSAD describes a common trust model that can be applied to specifications within the security automation domain, such as Security Content Automation Protocol (SCAP). Since information in the security automation domain is primarily exchanged using Extensible Markup Language (XML), the focus of this model is on the processing of XML documents. The trust model is composed of recommendations on how to use existing specifications to represent signatures, hashes, key information, and identity information in the context of an XML document within the security automation domain.
It's weird that we don't sign our content or validate signed content as it's a best security practice to provide signed content. We should do this for non-tailored content; although, an option to resign with a different signature would be great to. Obviously any content with invalid signatures should fail to run.
See https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/tmsad for specification, XSD, etc.