XML Signature Wrapping Still Considered Harmful: A Case Study on the Personal Health Record in Germany

Paul Höller,Alexander Krumeich,Luigi Lo Iacono
DOI: https://doi.org/10.1007/978-3-030-78120-01
2021-06-19
Abstract:XML Signature Wrapping (XSW) has been a relevant threat to web services for 15 years until today. Using the Personal Health Record (PHR), which is currently under development in Germany, we investigate a current SOAP-based web services system as a case study. In doing so, we highlight several deficiencies in defending against XSW. Using this real-world contemporary example as motivation, we introduce a guideline for more secure XML signature processing that provides practitioners with easier access to the effective countermeasures identified in the current state of research.
Cryptography and Security
What problem does this paper attempt to address?