TC resolutions to comments

["Scott Cantor" <cantor.2@osu.edu>]

Dave,

Just informing you of the TC's disposition of your remaining comments.
Minutes to the discussions of Oct 26th are here:
http://lists.oasis-open.org/archives/security-services/200410/msg00083.html

1. Proposed change to elementFormDefault

TC affirmed the original decision to use "unqualified", because it's the
default value for the attribute, and changing it at this late date was felt
to be unnecessary. While recognizing the possibility that it might be
confusing, nobody else had commented on it in the last 3 years.

2. Defining NameID and Issuer

TC resolved to factor out definition of NameIDType and clarify the
differences between these elements, per your (implicit) suggestion.

3. Use of MUST around XML Encryption and the need for unique ciphertext

TC affirmed decision to use stronger language than the XML Encryption
specification, while believing that its guidelines have generally been
interpreted as more than just recommendations.

4. Condition evaluation

TC resolved to make adjustments in the way Conditions are discussed,
including strengthening the requirements around evaluation such that they
MUST be evaluated and assertions MUST be disregarded if either Invalid or
Indeterminate.

Also resolved to fix ambiguities in the way evaluation takes place to insure
there are no contradictions (and my personal thanks for spotting this).

5. Use of MUST "when privacy is a consideration" with SessionIndex

TC resolved to accept your suggested changing to SHOULD as capturing the
intent.

Thanks...
Scott