Someone should go deep on the mailing list and standards body horrors of WS-* and OASIS/XACML and all that crap

For example, most libraries do something like: ``` valid = validate_xml_signature(xml_message, key) if valid: parse(xml_message) # note xml_message was not crytographically authenticated ```

It should be: ``` verified_bytes = validate_xml_signature(xml_message, key) def validate_xml_signature(message, key): signed_bytes, authenticated_tag = parse_signature(message) # cryptographic proof of signed_bytes if key.verify(signed_bytes, authenticated_tag): return signed_bytes

parse(verified_bytes) # parse into whatever you want i.e. SAML Assertion ```

Now this method is foolproof as you only use authenticated data. This is a rough description of how formal verification would apply to XML Signatures. Of course it wouldn't prevent processing vulnerabilities, say XML parsing (XXE) or XML signatures transforms (XSLT) which has its own set of footguns. Or vulnerabilities inside cryptographic primitives.

You do mention that companies should switch to something like OIDC/OAuth. Many large companies just don't have the resources to start switching when the current system just works, say a old company in healthcare. So they are stuck with a bad standard like SAML or XML signatures.

That's why I am securing libraries like ruby-saml to ensure that there are no more XML signature vulnerabilities. During the patch for ruby-saml, we redesigned the library to ensure that there are no more xml signature vulnerabilities https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f... https://github.com/SAML-Toolkits/ruby-saml/blob/fbbedc978300...

I am trying to apply this to all the other libraries. The problem is that we are not getting funding at all. Ruby-SAML's maintainer never got any new sponsorships, despite asking for it: https://github.com/sponsors/SAML-Toolkits It disincentives any security redesigns like this: it just takes too long, and quite thankless.

If you want to join our efforts, feel free to contact me at secure[@]securesaml[.]com