Subject: [KEYPROV] Name-space issues in DSKPP and PSKC

From: "Rundgren, Anders" <[email-masked]>
Date: Thu, 18 Oct 2007 12:42:04 +0100

If you compare 

     xmlns:dskpp="urn:ietf:params:xml:schema:keyprov:protocol"
     xmlns:pskc="urn:ietf:params:xml:ns:keyprov:container"

with for example

     xmlns:ds="http://www.w3.org/2000/09/xmldsig#"

it is not only the fact that you cannot dereference URNs that differ but
that the two former namespaces seem to lack version information.
Although you can use the version tag in the XML Schema to signify actual
version, I'm (as a protocol implementer), a bit skeptical regarding
mixing a potentially radically different v2 in the same name-space as
v1.

Personally I would not even try to put a v1.1 in the same name-space.
It is in fact very convenient to just instantiate the appropriate XML
object container based on the name-space and the top level element.  The
version tag does IMHO not add value, but it sure adds confusion.

Other: It seems that the majority of XML-based standards use
elementFormDefault="qualified" attributeFormDefault="unqualified"
I think this is preferable regardless if you use prefixes or not.

Regards
Anders Rundgren

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/keyprov

---

From: "Pei, Mingliang" <[email-masked]>
Date: Fri, 19 Oct 2007 13:27:31 -0700

Hi Anders,

Thank you for your comments and suggestions. Here are reasons that we
choose the current approach.

1. IANA has had many spec that uses the URI style for schema. Instead of
URL as schema for xmldsig, URI is good. One can find schema files via
IANA pages. See the following page for schemas defined / registered with
IANA:

http://www.iana.org/assignments/xml-registry/schema.html

2. Some other later specs also use this style for schema URIs, for
example, SAML.

urn:oasis:names:tc:SAML:2.0:protocol

defined in

http://docs.oasis-open.org/security/saml/v2.0/saml-schema-protocol-2.0.x
sd

3. To support versioning, we are changing to add :1.0 in the URI.

With regard to elementFormDefault="qualified"
attributeFormDefault="unqualified", most schema files do set them this
way. By default, it is "unqualified" if not specified. Some still
chooses to spell out even if both are set unqualified. For example, SAML
v2.0 schema:

  elementFormDefault="unqualified" attributeFormDefault="unqualified"
blockDefault="substitution" version="2.0"

The value controls whether the namespaces of the elements being used by
the schema will be hidden or exposed in instance documents. I tried to
verify some best practice about this usage. For example, here is one
link found from google about this topic.

http://www.xfront.com/HideVersusExpose.html

Personally I felt that unqualified allows simpler instance doc without
clutting of namespace. Also considering that the DSKPP schema is the top
"application" level use, unqualified element is mostly fine. PKSC
schema, on the other hand, is better to be "qualified" as it is a
building block for other schema to import.

We will review this further, and reply back soon. Thank you for the
suggestion.

- Ming

-----Original Message-----
From: Rundgren, Anders [mailto:[email-masked]] 
Sent: Thursday, October 18, 2007 4:42 AM
To: [email-masked]
Subject: [KEYPROV] Name-space issues in DSKPP and PSKC

If you compare 

with for example

Regards
Anders Rundgren