core-spec-wd-04

[Trevor Perrin <trevp@trevp.net>]

This version fleshes things out a little more (mainly with result codes, 
and more options on sign and verify).


http://www.oasis-open.org/apps/org/workgroup/dss/download.php/4051/oasis-dss-1.0-core-spec-wd-04.pdf
http://www.oasis-open.org/apps/org/workgroup/dss/download.php/4050/oasis-dss-1.0-core-spec-wd-04.doc
http://www.oasis-open.org/apps/org/workgroup/dss/download.php/4049/oasis-dss-1.0-core-schema-wd-04.xsd

Changes:
  - Added <ServicePolicy> per Pieter
  - Changed <Status> to <Result>, and fleshed it out, in a way that 
reflects some of Juan Carlos' suggestions, and gives it 2 layers of status 
codes similar to XKMS and SAML.
  - Removed <DocumentURI>, since it seemed there were more votes that way 
(Rich, John, Trevor, Andreas, vs. Gregor, Juan Carlos, and Pieter).  But I 
might have missed someone, and it's close, so we should discuss more.
  - Made <RequestID> an attribute on protocol messages, per last meeting
  - Added a <Properties> option to <SignRequest>
  - Added several options to <VerifyRequest>
  - Fleshed out <Verify> to discuss result codes, and "basic processing"
  - Renamed <ApplicationProfile> to <ServiceProfile>, to be more in line 
with <ServicePolicy>.  Perhaps this is a better name?

We still need to add a few more options to Sign and Verify if we want to 
meet all our requirements.  But we've got most of them now, I think.

Questions:
  - Is it okay for the server to return informative outputs even if the 
client didn't request them?  For example, should the server go ahead and 
return <ServiceProfile> and <ServicePolicy> outputs on its own if the 
client didn't request them, just for the client's information?
  - At the last meeting, we decided to discuss, on-list, the question of 
what support we need for Authentication methods within the protocol.  I 
made a start, and Nick responded.  Anyone else have thoughts?
http://lists.oasis-open.org/archives/dss/200310/msg00077.html


Trevor