Updates to Core - FW: [dss] Updated nested renewed timestamps

["Nick Pope" <pope@secstan.com>]

Stefan

When you next update the Core can you include the following changes relating
to time-stamping.

Nick

...

> 3) The definition of Timestamp Token in the Core spec 5.1.1 needs updating
> to allow several objects to be in <ds:reference>.
>

5.1.1 Replace:
---
<ds:SignedInfo>/<ds:Reference> [Required]
There MUST be a single <ds:Reference> element whose URI attribute
references the <ds:Object> containing the enveloped <TstInfo> element,
and whose Type attribute is equal to
urn:oasis:names:tc:dss:1.0:core:schema:XMLTimeStampToken.
The remaining <ds:Reference> element(s) will reference
the document or documents that are timestamped.
---
with suggested text:
---
<ds:SignedInfo>/<ds:Reference> [Required]
There MUST be a single <ds:Reference> element whose URI attribute
references the <ds:Object> containing the enveloped <TstInfo> element,
and whose Type attribute is equal to
urn:oasis:names:tc:dss:1.0:core:schema:XMLTimeStampToken.
For every input document being timestamped, there MUST be
a single <ds:Reference> element whose URI attribute references
the document.
[Note: Nothing disallows additional <ds:Reference> elements in
<ds:SignedInfo>.]
---


It may be that 5.1.3 step 7 needs to be updated for the less common case of
multiple document hashes (independent of the current discussion):
---
7.	Verify that there is a ds:SignedInfo/Reference element whose URI
attribute
correctly identifies the timestamped document.
---
Suggested text:
---
7.	Verify that each timestamped document is referenced by a single
ds:SignedInfo/Reference element.
---