Andreas Neustifter wrote:

Hi List,

I have to provide digital signatures of serialized C++ objects, I'm planing on using Boost::Serialization for the XML part.

Since XML signatures and XMLDsig in particular are difficult [1] and littered with pitfalls I was wondering if maybe the XML output of Boost::Serialization is stable enough to do a plain byte-oriented PKCSwhatever signature?

To summarize:

- C++ objects are serialized to XML with Boost::Serialization (XML is used since date has to be as human readable as possible).

- Serialized XML has to be digitally signed.

- XMLDsig is complicated [1]

Question:

Does Boost::Serialization with the XML backend produce bytewise the same data every time?

This would not and could not be guarenteed across differing library versions and platforms. I would guess that the best way to handle this would be to incorporate XMLDsig compliance into the xml serialization (xml_?archive) itself. I have no doubt what this is a difficult task - but that's why we make the big bucks. Robert Ramey