RE: Proposed Agenda for SSTC Call (Tue 22 Feb 2011)

["Cantor, Scott E." <cantor.2@osu.edu>]

I probably won't be on the call, but I might make it for a short bit.

> 4. AIs & progress update on current work-items:
> 
>   (a) Current electronic ballots: Metadata Profile for Algorithm Support.
> http://www.oasis-open.org/apps/org/workgroup/security/ballot.php?id=1999

Thomas, if we have to explicitly submit anything to Robin to get the CS published, let me know and I can do it. I don't think we do.

>   (h) Metadata extension for Login/Discovery (Scott)
>       - Status: Thomas submitted CSD request to Oasis on 15 Dec 2010.
>       - Status: awaiting response from Oasis.
>       - #339 on Oasis Issues Tracker: http://tinyurl.com/47yta4p

Robin completed this over the weekend. There are a few non-egregious glitches that are a result of the confusion over the new process and some issues with our older processes, so this is going to another round of WD->CSD no matter what.

There are two big takeaways:

Our specs should stop including normative references to their own schemas (referencing *other* schemas is ok). The Designated Cross Reference process is not meant to handle this case, it's overkill. Robin suggests a number of alternatives, one good one being having the spec submission for publication include a request to reference the stable schema URI under Related Work.

Our TC process for the Acknowledgements appendix is broken under the new TC rules, because we can't have the list of voting members added *after* we approve a draft.

I suggest a new "standard" default approach be for spec editors to include a list of the voting members in their later WDs once they get to a "CSD likely" stage. That's about all we can do, because we can't change it after the CSD vote, and we can't change the CSD list during a vote to CS.

The TC process states that the "chair compile the initial list" and that any TC member can request an addition or removal at any time. It does not say how that can work given the rules on document changes after a transition vote, but Robin's checking with the rules lawyers on it. In practice, we haven't had much of a problem with people asking.

>   (i) Enhanced Client or Proxy Profile (Scott)
>       - Status: WD02 uploaded last week.
> 
>   http://www.oasis-
> open.org/apps/org/workgroup/security/email/archives/201102/msg00027.html

This draft is roughly feature complete now, but I expect the material to undergo revision based on other work, and to improve the integration of the holder of key material. I did a lot of "see other spec for rules" to avoid duplication, but that may be a bit too hard to follow.

One change worth noting: I added a new SOAP header element by adding it to the old ECP schema/namespace from SAML 2.0, i.e., I'm updating that schema. I don't see any reason not to, and it doesn't break anything because it's a new global element, and because of how/when the header gets used.

>   (k) Errata document (Scott):
>       - Issue: wish to address usage of term "psudeorandom"
>       - See: http://tools.oasis-open.org/issues/browse/SECURITY-7
>       - Any updates?

See also:
http://tools.oasis-open.org/issues/browse/SECURITY-8

Fairly non-controversial.

-- Scott