Issue 101150 - The encrypted signature of manifest.xml should be stored in encrypted documents.
Summary: The encrypted signature of manifest.xml should be stored in encrypted documents.
Status: CONFIRMED
Alias: None
Product: General
Classification: Code
Component: code (show other issues)
Version: DEV300m45
Hardware: All All
: P3 Trivial (vote)
Target Milestone: ---
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-04-17 08:24 UTC by mikhail.voytenko
Modified: 2017-05-20 10:48 UTC (History)
6 users (show)

See Also:
Issue Type: FEATURE
Latest Confirmation in: ---
Developer Difficulty: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description mikhail.voytenko 2009-04-17 08:24:48 UTC 
As we have discussed on the last meeting it looks to make sense to protect the
manifest.xml in encrypted documents from changes. The idea was to create a
signature stream of the manifest.xml and encrypt it with the document password.
In this way the manifest.xml can no more be changed ( without password ) in a
protected document without OOo detecting it on opening.

mav->mib: As I understand this change does not conflict with the ODF
specification. For the files that do not have such a protection a warning/error
would be shown, but it still would be possible to open them. Am I right with my
understanding?
Comment 1 mikhail.voytenko 2009-04-17 08:27:10 UTC 
This is of course no defect.
Comment 2 malte_timmermann 2009-04-17 08:40:31 UTC 
I guess the warning thing needs to be discussed a little bit deeper.

Since we try to better protect newly created documents, we must figure out how
to handle old/existing documents, and documents written with other applications.

Since we talk about encrypted documents, I guess we wouldn't again stumble in
some security issues, like with digital signatures and old documents.

TBD with UX...
Comment 3 mikhail.voytenko 2009-08-14 11:06:29 UTC 
The handling of the old documents is still not clear. So it was decided not to
implement the feature for 3.2.
Changing the Target accordingly.
Comment 4 Marcus 2017-05-20 10:48:05 UTC 
Reset assigne to the default "issues@openoffice.apache.org".