Re: ACTION-300 Create sample to illustrate ECDH-ES with AES key wrap

Since Pratik was asking for it, here's how Kelvin's example would turn out
if one leveraged the KeyDerivationMethod type from the Derived Keys 
document.

I'm arguing that leveraging the dkey:KeyDerivationMethod type is more 
generic and also more inline with existing practice in XMLSec of having a 
"...MethodType" (like EncryptionMethod in EncryptedData) where you specify 
the actual algorithm as a URI and then possibly have algorithm-specific 
parameters as a child element.

(If we merged XMLEnc 1.1 and DerivedKeys then the extra namespace would go 
away, of course).

So the example becomes:

<xenc:EncryptedData
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
   xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
   xmlns:dsig11="http://www.w3.org/2009/xmldsig11#"
   xmlns:xenc11="http://www.w3.org/2009/xmlenc11#"
   xmlns:dkey="http://www.w3.org/2009/xmlsec-dkey#"
   Type="http://www.w3.org/2001/04/xmlenc#">

   <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" />
   <!-- describes the encrypted AES content encryption key -->
   <ds:KeyInfo>
     <xenc:EncryptedKey>
       <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#kw-aes128"/>
       <!-- describes the key encryption key -->
       <ds:KeyInfo>
         <xenc:AgreementMethod Algorithm="http://www.w3.org/2009/xmlenc11#ECDH-ES">
<!-- This is where the change starts -->
           <dkey:KeyDerivationMethod Algorithm="http://www.w3.org/2009/xmlenc11#SP80056AKDF">
             <xenc11:SP80056AConcatKDFParams
               hashAlgorithm="http://www.w3.org/2001/04/xmlenc#sha256"
               AlgorithmID="00" PartyUInfo="" PartyVInfo=""/>
           </dkey:KeyDerivationMethod>
<!-- This is where it ends -->
           <xenc:OriginatorKeyInfo>
             <ds:KeyValue>
               <dsig11:ECPublicKey>
                 <!-- ephemeral ECC public key of the originator -->
               </dsig11:ECPublicKey>
             </ds:KeyValue>
           </xenc:OriginatorKeyInfo>
           <xenc:RecipientKeyInfo>
             <ds:X509Data>
               <!-- hint for the recipient's private key -->
             </ds:X509Data>
           </xenc:RecipientKeyInfo>
         </xenc:AgreementMethod>
       </ds:KeyInfo>
       <xenc:CipherData>
         <xenc:CipherValue><!-- encrypted AES content encryption key --></xenc:CipherValue>
       </xenc:CipherData>
     </xenc:EncryptedKey>
   </ds:KeyInfo>

   <xenc:CipherData>
     <xenc:CipherValue>
       <!-- encrypted data -->
     </xenc:CipherValue>
   </xenc:CipherData>

</xenc:EncryptedData>