RE: [dss] plans for next draft

[<Frederick.Hirsch@nokia.com>]

Thanks Rich

To summarize what I  think I saw in the TAG finding,  ( http://www.w3.org/2001/tag/doc/qnameids.html )

1. QNames were originally intended to be used for element and attribute *names*, allowing the XML processor to easily map the prefix to the corresponding URI.

2. The TAG accepts the common practice of using QNames as values of element content or attribute values

3. QNames aren't particularly useful unless the processor can map the prefix to the URI, yet this can put an additional burden on a processor, to process all QNames correctly. O

I think I got that right. 

Also, I might add:

a. a common use seems to be that a QName is used like a string, yet if used properly the prefix should map to a URI and the prefix should not be necessarily fixed. If not mapped to a URI the use of the QName is somewhat misleading since it isn't obvious it is only a string.

b. QNames as values can make canonicalization awkward, and DSS may have signatures associated with various components, we think.

Summary

(1) we are in compliance since they are no MUSTS in this TAG finding, common practice is accepted

(2) I agree, we should use a URI, if only to remove potential canonicalization issues, and to avoid ambiguity.

So instead of foo:value we could use dss-uri/value, easily mapping all proposed QNames.

I'm not sure I see the value of using QNames as values instead of URIs, apart from brevity.

Does this make sense?

regards, Frederick
 
Frederick Hirsch
Nokia Mobile Phones




> -----Original Message-----
> From: ext Rich Salz [mailto:rsalz@datapower.com]
> Sent: Tuesday, November 18, 2003 4:38 PM
> To: Trevor Perrin
> Cc: dss@lists.oasis-open.org
> Subject: Re: [dss] plans for next draft
> 
> 
> > 4)  Add a 'type' QName attribute to the <ContentTimestamp>,
> > <SignatureTimestamp>, and <ReturnUpdatedSignature> optional 
> inputs.  This
> > allows these optional inputs to be extended, per 
> Frederick's suggestion [3].
> 
> The W3C technical architecture group has a document on when 
> and how to use
> QName's.  We should make sure we're in complaince.  Better 
> yet, why not
> just use a URI?
> 
> 	/r$
> 
> --
> Rich Salz                  Chief Security Architect
> DataPower Technology       http://www.datapower.com
> XS40 XML Security Gateway  http://www.datapower.com/products/xs40.html
> XML Security Overview      
> http://www.datapower.com/xmldev/xmlsecurity.html
> 
> 
> To unsubscribe from this mailing list (and be removed from 
> the roster of the OASIS TC), go to 
> http://www.oasis-open.org/apps/org/workgroup/dss/members/leave
> _workgroup.php.
> 
>