Timestamping Profile Q 2/3: Bindings

[Trevor Perrin <trevp@trevp.net>]

We'll probably only have a few "transport bindings" (SOAP-over-HTTP, 
straight HTTP/POST) and a few "security bindings" (TLS, WS-Security).

Since most profiles will draw upon these, should they be described in a new 
section of the core document?  Or a separate document?

I don't have much SOAP or WS-Security experience; does anyone else want to 
take the lead in defining transport and security bindings?  It's probably a 
fair amount of work, with lots of questions to answer (Should most profiles 
use SOAP, or just a simpler HTTP/POST binding?  SOAP 1.1 or 1.2?  Which 
security bindings should be mandatory and which optional for most 
profiles?  etc..).

XKMS and SAML look like good starting points, to see how other people have 
tackled this.


Trevor