Subject: Signature DTD

From: [email-masked]
Date: Tue, 23 Feb 1999 15:17:13 -0500

Here is the result of a pass over the material the Kent Davidson provided.
I have re-instituted Value with an optional ID and elminated the namespace
stuff, etc.  In order to get drafts in by the deadline, which is this week,
I don't think we have time for any significant further changes.

<!ELEMENT IOTPSignatures (Signature+,Certificate*)>
    <!ELEMENT Signature (Manifest, Value+) >
        <!ELEMENT Manifest (
            Algorithm+,
            Digest+,
            Attributes?,
            OriginatorInfo,
            RecipientInfo+,
        )
        <!ATTLIST Manifest
            LocatorHRefBase     CDATA          #IMPLIED
            <!ELEMENT Algorithm (Parameter*)>
            <!ATTRLIST Algorithm
                type            (digest|signature|keyagreement)   #IMPLIED
                name            NMTOKEN                         #REQUIRED
                ID              ID
            <!ELEMENT Digest (Value)>
            <!ATTLIST Digest
                LocatorHREF         NMTOKEN
                DigestAlgorithmRef  IDREF
            <!ELEMENT Attributes (Attribute+)>
            <!ELEMENT Attribute ( #PCDATA, IOTPSignatureType )>
            <!ATTLIST Attribute
                type          NMTOKEN     #REQUIRED
                critical ( true | false ) #REQUIRED    'false'
            <!ELEMENT IOTPSignatureType EMPTY>
            <!ATTLIST IOTPSignatureType
                SigType (Other|Payment|Delivery)    #REQUIRED
            <!ELEMENT OriginatorInfo ANY>
            <!ATTLIST OriginatorInfo
                OriginatorRef           NMTOKENS    #IMPLIED
            <!ELEMENT RecipientInfo ANY>
            <!ATTLIST RecipientInfo
                SignatureAlgorithmRef   IDREF       #REQUIRED
                SignatureValueRef       IDREF       #REQUIRED
                RecipientRef            NMTOKENS    #IMPLIED
            <!ELEMENT Parameter ANY>
            <!ATTLIST Parameter
                type          PCDATA    #REQUIRED
            <!ELEMENT Certificate (
                IssuerAndSerialNumber,
                ( Value | Locator )
            )>
            <!ATTLIST Certificate
                type          NMTOKEN    #REQUIRED
            <!ELEMENT IssuerAndSerialNumber EMPTY >
            <!ATTLIST IssuerAndSerialNumber
                issuer        CDATA    #REQUIRED
                number        CDATA    #REQUIRED
            <!ELEMENT Value ( #PCDATA )>
            <!ATTLIST Value
                id            ID       #IMPLIED
                encoding ( base64 | none ) #REQUIRED 'none'

Algorithm type='digest' (all mandatory to implement):
- "urn:ibm:dom-hash"
- "urn:fips:sha1"
- "urn:rsa:md5"

ParameterType="AlgorithmRef"

Algorithms type='signature' (dsa & hmac mandatory to implment, rsa
recommended):
- "urn:us.gov:dsa"
- "urn:ibm:hmac"
- "urn:rsa:rsa"

e.g.
<Algorithm ID=A1 type="digest" name="urn:ibm:dom-hash">
    <Parameter type='AlgorithmRef'>A2</Parameter>
</Algorithm>
<Algorithm ID=A2 type="digest" name="urn:fips:sha1">
</Algorithm>
<Algorithm ID=A3 type="signature" name="urn:ibm:hmac">
    <Parameter type='AlgorithmRef'>A1</Parameter>
</Algorithm>

TODO:
- Parameters within all algorithms to point to "sub" algorithms
- Other parameters specific to digest and signature algorithms

990210
------
Discussions:
- Moving all algorithms to one place
- Having multiple signatures for multiple recipients
- Cases sensitivity of example above where 'case-sensitive' ID=A2 and
<Param>a2</Param>
    may be parsed by different parts of the application.
- Some wants algorithm references to be an IDREFs attribute within
Algorithm

Donald E. Eastlake, 3rd
17 Skyline Drive, Hawthorne, NY 10532 USA
[email-masked]   tel: 1-914-784-7913, fax: 1-914-784-3833
Notes: Donald Eastlake/Hawthorne/IBM@IBMUS

home: 65 Shindegan Hill Road, RR#1, Carmel, NY 10512 USA
[email-masked]   tel: 1-914-276-2668

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: David Burdett <[email-masked]>
Date: Wed, 24 Feb 1999 13:30:57 -0000

I've reviewed Don's version of the dsig DTD and spotted a few problems.
So I've revised the DTD and included the revisions and details of the
changes made below. If anybody can spot any more problems please let me
know.

David
REVISED IOTP/DSIG DTD
=====================
Changes:
- added optional ID attributes to IOTPSignatures, Signature and
Certicicate elemens to conform with IOTP requirement for blocks and
componenents to have ID attributes so that they can be referenced
- added #REQUIRED to a number of elements: Algorithm/ID,
Digest/LocatorHREF, Digest/DigestAlgorithmRef
- removed 'false' from Attribute/critical, and 'none' from
Value/encoding as invalid XML
- made IOTPSignatureType element optional as this will allow Signature
definition to potentially be reused
- changed IOTPSignatureType/SigType allowable values to NMTOKEN and will
enumerate valid values in the IOTP specification to allow extensibility
to new types of IOTP signatures
- Changed OriginatorInfo/OriginatorRef from NMTOKENS to NMTOKEN as there
can only be one originator
- Changed RecipientInfo/RecipientRef to 'RecipientRefs' as there may be
more than one recipient
- moved Alghorithm/Id to first attribute of Algorithm element
- added Locator element definition as it was missing

<!--
******************************************************
* IOTP SIGNATURES BLOCK DEFINITION                   *
******************************************************
 -->

<!ELEMENT IOTPSignatures (Signature+, Certificate*) >
<!ATTLIST IOTPSignatures
  ID                ID      #IMPLIED >

<!--
******************************************************
* IOTP SIGNAUTRE COMPPONENT DEFINITION               *
******************************************************
 -->

<!ATTLIST Signature
  ID                ID      #IMPLIED >

<!ELEMENT Manifest 
  (Algorithm+,
   Digest+,
   Attributes?,
   OriginatorInfo,
   RecipientInfo+,
  )
<!ATTLIST Manifest
  LocatorHRefBase   CDATA   #IMPLIED >

<!ELEMENT Algorithm (Parameter*) >
<!ATTRLIST Algorithm
 ID                 ID      #REQUIRED
 type  (digest|signature|keyagreement) #IMPLIED
 name               NMTOKEN #REQUIRED >

<!ELEMENT Digest (Value) >
<!ATTLIST Digest
 LocatorHREF        NMTOKEN #REQUIRED
 DigestAlgorithmRef IDREF   #REQUIRED >

<!ELEMENT Attributes (Attribute+) >

<!ELEMENT Attribute ( #PCDATA, IOTPSignatureType? ) >
<!ATTLIST Attribute
 type               NMTOKEN #REQUIRED
 critical  ( true | false ) #REQUIRED >

<!ELEMENT IOTPSignatureType EMPTY >
<!ATTLIST IOTPSignatureType
 SigType            NMTOKEN #REQUIRED >

<!ELEMENT OriginatorInfo ANY >
<!ATTLIST OriginatorInfo
 OriginatorRef      NMTOKEN #IMPLIED >

<!ELEMENT RecipientInfo ANY >
<!ATTLIST RecipientInfo
 SignatureAlgorithmRef IDREF #REQUIRED
 SignatureValueRef  IDREF    #REQUIRED
 RecipientRefs      NMTOKENS #IMPLIED >

<!ELEMENT Parameter ANY >
<!ATTLIST Parameter
 type               PCDATA  #REQUIRED >

<!ELEMENT Certificate (
  IssuerAndSerialNumber 
  ( Value | Locator ) )>
<!ATTLIST Certificate
 type               NMTOKEN #REQUIRED >

 number             CDATA   #REQUIRED >

<!ELEMENT Value ( #PCDATA ) >
<!ATTLIST Value
 id                 ID      #IMPLIED
 encoding ( base64 | none ) #REQUIRED >

<!ELEMENT Locator EMPTY>
<!ATTLIST Locator
 href               CDATA   #REQUIRED >

>----------
>From: 	[email-masked][SMTP:[email-masked]]
>Sent: 	23 February 1999 12:17
>To: 	[email-masked]
>Subject: 	Signature DTD
>