After researching the 1.0 process and the current OASIS
requirements and bouncing it off Prateek, Eve, and Jeff, I've put
together the attached timeline for everyone to review and comment.
In order to use this as the schedule, it means that on the 22-April
call, we MUST make final decisions on what we will include in V1.1. We then
have to have the spec's ready for SSTC Last Call on 29-April.
Note that we probably have a bit of slack in item #8 below,
so we might squeeze out an extra week for our internal reviews, etc. But
I think we should shoot for the dates below.
Note that we need to get at least 3 attestations of
implementation for the V1.1 spec. So PLEASE start thinking about whether
your company can provide that. I am currently assuming we need to follow
the process we used for V1.1, where I think we obtained attestations for each major
area of functionality (e.g. Browser/POST, Browser/Artifact). Do folks
feel it's necessary to follow this same model for the 1.1 release?
Here's the SSTC's "Committee Last Call
and the OASIS standardization process:
To me, it seems the earliest we could get the specs to OASIS
is 15-July for an OASIS vote in August.
It's now 18-April. Given the discussions on Tuesday's
call, I honestly don't believe we can vote to start the SSTC Last Call
period until probably the end of this month (29-April). I personally
think this is very aggressive, but possibly doable. However, with our
SSTC-mandated 2-week Last Call period, I don't see how we can realistically
make a request to OASIS to start their 30-day Public Review period until toward
the end of May. This means we can't close the public review, work on any
public comments, and prepare the submission documents until the end of
June. We have to have stuff in by the 15th of a month.
Since it doesn't look, to me at least, that it's possible to do
this in June, it pushes us to July 15 for OASIS submission.
I think the timeline looks something like this:
- [Now] The SSTC produces working drafts of the
- [Target: 29-April] When the TC agrees that the draft
specs are ready for TC last call, the Chairs announce the start of the TC
"Last Call period" with at least a 2 week cutoff date.
The announcement is sent to the TC and the next version of OASIS News.
- [Target: 13-May] Cutoff date for all Last Call input.
- [Target: 20-May] All outstanding issues have been dealt
with according to the last call process. The specs now become
"Candidate Committee Spec's" and the TC addresses any
outstanding non-normative editorial issues.
- [Target: 27-May] Once editorial issues are resolved,
the TC votes to turn the "candidate" spec into the official
- [Target: 28-May] The TC chairs must announce to OASIS
that the Committee Spec is available for a 30-day Public Review period.
- [Target: 1-July (1st Tuesday following
30-day period)] The TC must do a final (re-)approval of the spec as a
Committee Spec and vote to submit the Committee Spec to OASIS
- [Target: 1-July] Chairs begin to prepare OASIS spec
submission document which includes
- Reference links to specs
- Certification by at least 3 vendors successfully using
- Disposition of public review comments
- IPR policy compliance statements
- [Target: 15-July] The submission document must be
submitted to OASIS by the 15th of the month
- [Target: 1-August] OASIS will make the announcement of
the TC's request for standardization of the committee spec by the 1st
of the month.
- [Target: 15-August] Voting will commence by the 15th
of the month.
- [Target: 31-August] Voting will complete at the end of
RSA Security Inc.
The Most Trusted Name in e-Security