Comments on EPM

["Nick Pope" <pope@secstan.com>]

Ed,

In looking through the EPM I have one major issue which we need to consider:
whether the OASIS spec can be a self contained specification that can be
implemented without depending on EPM specification.  It is acceptable that
there are EPM owned extensions to this specifications, I am not sure whether
basic parts of the specification should be dependent on an extenal EPM
document.  In particular:

a) Section 1.2 states:
The structures described in this specification are contained in the schema
file [EPM].  All schema listings in the current document are excerpts from
that schema file.  In the case of a disagreement between the schema file and
this document, the schema file takes precedence.

This implies that the implementor has to use the EPM schema if it is sure to
be correct.  I would say it is up to EPM to make sure that it schema follows
the standard profile.

b) Section 2.5

Can the EPM transport binding be included within the Profile.

c) Section 9 (?) Signing templates example

This looks a very useful feature.  Can the basic rules for the templates be
included with these examples so that they can be used within DSS.

--

Regarding the issues:

1) I believe that we started a discussion on this during the DSS call.  Can
you send this issue to start a separate email thread for discussion outside
the context of EPM.

2) Yes - I agree that this should be indicated different from a normal input
document.

3) Not sure what the issue is here.

4) Agreed - Trevor ?

5) No - I believe that schema should be defined within the DSS document.

Nick