<?xml version="1.0"?>
<!--
Schema  updates:
1.  Changed RSAKeyValue and 
    RSAKeyValueType to RSAKeyPair and RSAKeyPairType respectively
2.  Replace qname with URI using open enumeration technique described in
        http://lists.oasis-open.org/archives/wss/200402/msg00011.html
    Rationale for the change is given at
        http://www.w3.org/2001/tag/doc/qnameids.html#sec-archrec
-->
<!DOCTYPE schema [
  <!--  The URI for the XKMS namespace, and also the base URI used for
        URI's defined by the specification. -->
  <!ENTITY xkms 'http://www.w3.org/2002/03/xkms#'>
]>

<schema targetNamespace="&xkms;" xmlns:xkms="&xkms;" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" attributeFormDefault="unqualified">
	<import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
	<import namespace="http://www.w3.org/2001/04/xmlenc#" schemaLocation="xenc-schema.xsd"/>
	<annotation>
		<documentation xml:lang="en">
			     XML Schema for XKMS 2.0 Last Call Candidate 2003
		</documentation>
	</annotation>
	<!-- /Namespace -->
	<!-- MessageAbstractType -->
	<complexType name="MessageAbstractType" abstract="true">
		<sequence>
			<element ref="ds:Signature" minOccurs="0"/>
			<element ref="xkms:MessageExtension" minOccurs="0" maxOccurs="unbounded"/>
			<element ref="xkms:OpaqueClientData" minOccurs="0"/>
		</sequence>
		<attribute name="Id" type="ID" use="required"/>
		<attribute name="Service" type="anyURI" use="required"/>
		<attribute name="Nonce" type="base64Binary" use="optional"/>
	</complexType>
	<!-- /MessageAbstractType -->
	<!-- MessageExtension -->
	<element name="MessageExtension" type="xkms:MessageExtensionAbstractType" abstract="true"/>
	<complexType name="MessageExtensionAbstractType" abstract="true"/>
	<!-- /MessageExtension -->
	<!-- OpaqueClientData -->
	<element name="OpaqueClientData" type="xkms:OpaqueClientDataType"/>
	<complexType name="OpaqueClientDataType">
		<sequence maxOccurs="unbounded">
			<element ref="xkms:OpaqueData" minOccurs="0"/>
		</sequence>
	</complexType>
	<element name="OpaqueData" type="base64Binary"/>
	<!-- /OpaqueClientData -->
	<!-- RequestAbstractType -->
	<complexType name="RequestAbstractType" abstract="true">
		<complexContent>
			<extension base="xkms:MessageAbstractType">
				<sequence>
					<element ref="xkms:ResponseMechanism" minOccurs="0" maxOccurs="unbounded"/>
					<element ref="xkms:RespondWith" minOccurs="0" maxOccurs="unbounded"/>
					<element ref="xkms:PendingNotification" minOccurs="0"/>
				</sequence>
				<attribute name="OriginalRequestId" type="NCName" use="optional"/>
				<attribute name="ResponseLimit" type="integer" use="optional"/>
			</extension>
		</complexContent>
	</complexType>
	<!-- /RequestAbstractType -->
	<!-- ResponseMechanism -->
        <simpleType name="ResponseMechanismEnum">
          <restriction base="anyURI">
            <enumeration value="&xkms;Pending"/>
            <enumeration value="&xkms;Represent"/>
            <enumeration value="&xkms;RequestSignatureValue"/>
          </restriction>
        </simpleType>
        <simpleType name="ResponseMechanismOpenEnum">
          <union memberTypes="xkms:ResponseMechanismEnum anyURI"/>
        </simpleType>
	<element name="ResponseMechanism" type="xkms:ResponseMechanismOpenEnum"/>
	<!-- /ResponseMechanism -->
	<!-- RespondWith -->
        <simpleType name="RespondWithEnum">
                <restriction base="anyURI">
                        <enumeration value="&xkms;KeyName"/>
                        <enumeration value="&xkms;KeyValue"/>
                        <enumeration value="&xkms;X509Cert"/>
                        <enumeration value="&xkms;X509Chain"/>
                        <enumeration value="&xkms;X509CRL"/>
                        <enumeration value="&xkms;OCSP"/>
                        <enumeration value="&xkms;RetrievalMethod"/>
                        <enumeration value="&xkms;PGP"/>
                        <enumeration value="&xkms;PGPWeb"/>
                        <enumeration value="&xkms;SPKI"/>
                        <enumeration value="&xkms;PrivateKey"/>
                </restriction>
        </simpleType>
        <simpleType name="RespondWithOpenEnum">
                <union memberTypes="xkms:RespondWithEnum anyURI"/>
        </simpleType>
	<element name="RespondWith" type="xkms:RespondWithOpenEnum"/>
	<!-- /RespondWith -->
	<!-- PendingNotification -->
	<element name="PendingNotification" type="xkms:PendingNotificationType"/>
	<complexType name="PendingNotificationType">
		<attribute name="Mechanism" type="anyURI" use="required"/>
		<attribute name="Identifier" type="anyURI" use="required"/>
	</complexType>
	<!-- /PendingNotification -->
	<!-- PendingRequest -->
	<element name="PendingRequest" type="xkms:PendingRequestType"/>
	<complexType name="PendingRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<attribute name="ResponseId" type="NCName" use="required"/>
			</extension>
		</complexContent>
	</complexType>
	<!-- /PendingRequest -->
	<!-- ResultType -->
	<element name="Result" type="xkms:ResultType"/>
        <simpleType name="ResultMajorEnum">
                <restriction base="anyURI">
                        <enumeration value="&xkms;Success"/>
                        <enumeration value="&xkms;VersionMismatch"/>
                        <enumeration value="&xkms;Sender"/>
                        <enumeration value="&xkms;Receiver"/>
                        <enumeration value="&xkms;Represent"/>
                        <enumeration value="&xkms;Pending"/>
                </restriction>
        </simpleType>
        <simpleType name="ResultMajorOpenEnum">
                <union memberTypes="xkms:ResultMajorEnum anyURI"/>
        </simpleType>
        <simpleType name="ResultMinorEnum">
                <restriction base="anyURI">
                        <enumeration value="&xkms;NoMatch"/>
                        <enumeration value="&xkms;TooManyResponses"/>
                        <enumeration value="&xkms;Incomplete"/>
                        <enumeration value="&xkms;Failure"/>
                        <enumeration value="&xkms;Refused"/>
                        <enumeration value="&xkms;NoAuthentication"/>
                        <enumeration value="&xkms;MessageNotSupported"/>
                        <enumeration value="&xkms;UnknownResponseId"/>
                        <enumeration value="&xkms;RepresentRequired"/>
                        <enumeration value="&xkms;NotSynchronous"/>
                </restriction>
        </simpleType>
        <simpleType name="ResultMinorOpenEnum">
                <union memberTypes="xkms:ResultMinorEnum anyURI"/>
        </simpleType>
	<complexType name="ResultType">
		<complexContent>
			<extension base="xkms:MessageAbstractType">
				<sequence>
					<element ref="xkms:RequestSignatureValue" minOccurs="0"/>
				</sequence>
				<attribute name="ResultMajor" type="xkms:ResultMajorOpenEnum" use="required"/>
				<attribute name="ResultMinor" type="xkms:ResultMinorOpenEnum" use="optional"/>
				<attribute name="RequestId" type="NCName" use="optional"/>
			</extension>
		</complexContent>
	</complexType>
	<!-- /ResultType -->
	<!-- RequestSignatureValue -->
	<element name="RequestSignatureValue" type="ds:SignatureValueType"/>
	<!-- /RequestSignatureValue -->
	<!-- CompoundRequest -->
	<element name="CompoundRequest" type="xkms:CompoundRequestType"/>
	<complexType name="CompoundRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<choice maxOccurs="unbounded">
					<element ref="xkms:LocateRequest"/>
					<element ref="xkms:ValidateRequest"/>
					<element ref="xkms:RegisterRequest"/>
					<element ref="xkms:ReissueRequest"/>
					<element ref="xkms:RecoverRequest"/>
					<element ref="xkms:RevokeRequest"/>
				</choice>
			</extension>
		</complexContent>
	</complexType>
	<!-- /CompoundRequest -->
	<!-- CompoundResult -->
	<element name="CompoundResult" type="xkms:CompoundResultType"/>
	<complexType name="CompoundResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<choice minOccurs="0" maxOccurs="unbounded">
					<element ref="xkms:LocateResult"/>
					<element ref="xkms:ValidateResult"/>
					<element ref="xkms:RegisterResult"/>
					<element ref="xkms:ReissueResult"/>
					<element ref="xkms:RecoverResult"/>
					<element ref="xkms:RevokeResult"/>
				</choice>
			</extension>
		</complexContent>
	</complexType>
	<!-- /CompoundResult -->
	<!-- StatusRequest -->
	<element name="StatusRequest" type="xkms:StatusRequestType"/>
	<complexType name="StatusRequestType">
		<complexContent>
			<extension base="xkms:PendingRequestType"/>
		</complexContent>
	</complexType>
	<!-- /StatusRequest -->
	<!-- StatusResult -->
	<element name="StatusResult" type="xkms:StatusResultType"/>
	<complexType name="StatusResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<attribute name="Success" type="integer" use="optional"/>
				<attribute name="Failure" type="integer" use="optional"/>
				<attribute name="Pending" type="integer" use="optional"/>
			</extension>
		</complexContent>
	</complexType>
	<!-- /StatusResult -->
	<!-- KeyBindingAbstractType-->
	<complexType name="KeyBindingAbstractType" abstract="true">
		<sequence>
			<element ref="ds:KeyInfo" minOccurs="0"/>
			<element ref="xkms:KeyUsage" minOccurs="0" maxOccurs="3"/>
			<element ref="xkms:UseKeyWith" minOccurs="0" maxOccurs="unbounded"/>
		</sequence>
		<attribute name="Id" type="ID" use="optional"/>
	</complexType>
	<!-- /KeyBindingAbstractType-->
	<!-- UnverifiedKeyBinding -->
	<element name="UnverifiedKeyBinding" type="xkms:UnverifiedKeyBindingType"/>
	<complexType name="UnverifiedKeyBindingType">
		<complexContent>
			<extension base="xkms:KeyBindingAbstractType">
				<sequence>
					<element ref="xkms:ValidityInterval" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /UnverifiedKeyBinding -->
	<!-- KeyBinding -->
	<element name="KeyBinding" type="xkms:KeyBindingType"/>
	<complexType name="KeyBindingType">
		<complexContent>
			<extension base="xkms:UnverifiedKeyBindingType">
				<sequence>
					<element ref="xkms:Status"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /KeyBinding -->
	<!-- KeyUsage -->
	<simpleType name="KeyUsageEnum">
		<restriction base="anyURI">
			<enumeration value="&xkms;Encryption"/>
			<enumeration value="&xkms;Signature"/>
			<enumeration value="&xkms;Exchange"/>
		</restriction>
	</simpleType>
	<element name="KeyUsage" type="xkms:KeyUsageEnum"/>
	<!-- /KeyUsage -->
	<!-- UseKeyWith -->
	<element name="UseKeyWith" type="xkms:UseKeyWithType"/>
	<complexType name="UseKeyWithType">
		<attribute name="Application" type="anyURI" use="required"/>
		<attribute name="Identifier" type="string" use="required"/>
	</complexType>
	<!-- /UseKeyWith -->
	<!-- Status -->
	<element name="Status" type="xkms:StatusType"/>
	<complexType name="StatusType">
		<sequence>
			<element ref="xkms:ValidReason" minOccurs="0" maxOccurs="unbounded"/>
			<element ref="xkms:IndeterminateReason" minOccurs="0" maxOccurs="unbounded"/>
			<element ref="xkms:InvalidReason" minOccurs="0" maxOccurs="unbounded"/>
		</sequence>
		<attribute name="StatusValue" type="xkms:KeyBindingEnum" use="required"/>
	</complexType>
	<simpleType name="KeyBindingEnum">
		<restriction base="anyURI">
			<enumeration value="&xkms;Valid"/>
			<enumeration value="&xkms;Invalid"/>
			<enumeration value="&xkms;Indeterminate"/>
		</restriction>
	</simpleType>
	<!-- /Status -->
	<!-- Reason -->
        <simpleType name="ReasonEnum">
                <restriction base="anyURI">
                        <enumeration value="&xkms;IssuerTrust"/>
                        <enumeration value="&xkms;RevocationStatus"/>
                        <enumeration value="&xkms;ValidityInterval"/>
                        <enumeration value="&xkms;Signature"/>
                </restriction>
        </simpleType>
        <simpleType name="ReasonOpenEnum">
                <union memberTypes="xkms:ReasonEnum anyURI"/>
        </simpleType>
	<element name="ValidReason" type="xkms:ReasonOpenEnum"/>
	<element name="InvalidReason" type="xkms:ReasonOpenEnum"/>
	<element name="IndeterminateReason" type="xkms:ReasonOpenEnum"/>
	<!-- /Reason -->
	<!-- ValidityInterval -->
	<element name="ValidityInterval" type="xkms:ValidityIntervalType"/>
	<complexType name="ValidityIntervalType">
		<attribute name="NotBefore" type="dateTime" use="optional"/>
		<attribute name="NotOnOrAfter" type="dateTime" use="optional"/>
	</complexType>
	<!-- /ValidityInterval -->
	<!-- QueryKeyBinding -->
	<element name="QueryKeyBinding" type="xkms:QueryKeyBindingType"/>
	<complexType name="QueryKeyBindingType">
		<complexContent>
			<extension base="xkms:KeyBindingAbstractType">
				<sequence>
					<element ref="xkms:TimeInstant" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /QueryKeyBinding -->
	<!-- TimeInstant -->
	<element name="TimeInstant" type="xkms:TimeInstantType"/>
	<complexType name="TimeInstantType">
		<attribute name="Time" type="dateTime" use="required"/>
	</complexType>
	<!-- /TimeInstant -->
	<!-- PrototypeKeyBinding -->
	<element name="PrototypeKeyBinding" type="xkms:PrototypeKeyBindingType"/>
	<complexType name="PrototypeKeyBindingType">
		<complexContent>
			<extension base="xkms:KeyBindingAbstractType">
				<sequence>
					<element ref="xkms:ValidityInterval" minOccurs="0"/>
					<element ref="xkms:RevocationCodeIdentifier" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /PrototypeKeyBinding -->
	<!-- RevocationCodeIdentifier -->
	<element name="RevocationCodeIdentifier" type="xkms:RevocationCodeIdentifierType"/>
	<simpleType name="RevocationCodeIdentifierType">
		<restriction base="base64Binary"/>
	</simpleType>
	<!-- /RevocationCodeIdentifier -->
	<!-- LocateRequest -->
	<element name="LocateRequest" type="xkms:LocateRequestType"/>
	<complexType name="LocateRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<sequence>
					<element ref="xkms:QueryKeyBinding"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /LocateRequest -->
	<!-- LocateResult -->
	<element name="LocateResult" type="xkms:LocateResultType"/>
	<complexType name="LocateResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<sequence>
					<element ref="xkms:UnverifiedKeyBinding" minOccurs="0" maxOccurs="unbounded"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /LocateResult -->
	<!-- ValidateRequest -->
	<element name="ValidateRequest" type="xkms:ValidateRequestType"/>
	<complexType name="ValidateRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<sequence>
					<element ref="xkms:QueryKeyBinding"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /ValidateRequest -->
	<!-- ValidateResult -->
	<element name="ValidateResult" type="xkms:ValidateResultType"/>
	<complexType name="ValidateResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<sequence>
					<element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /ValidateResult -->
	<!-- Authentication -->
	<element name="Authentication" type="xkms:AuthenticationType"/>
	<complexType name="AuthenticationType">
		<sequence>
			<element ref="xkms:KeyBindingAuthentication" minOccurs="0"/>
			<element ref="xkms:NotBoundAuthentication" minOccurs="0"/>
		</sequence>
	</complexType>
	<!-- /Authentication -->
	<!-- KeyBindingAuthentication -->
	<element name="KeyBindingAuthentication" type="xkms:KeyBindingAuthenticationType"/>
	<complexType name="KeyBindingAuthenticationType">
		<sequence>
			<element ref="ds:Signature"/>
		</sequence>
	</complexType>
	<!-- /KeyBindingAuthentication -->
	<!-- NotBoundAuthentication -->
	<element name="NotBoundAuthentication" type="xkms:NotBoundAuthenticationType"/>
	<complexType name="NotBoundAuthenticationType">
		<attribute name="Protocol" type="anyURI" use="required"/>
		<attribute name="Value" type="base64Binary" use="required"/>
	</complexType>
	<!-- /NotBoundAuthentication -->
	<!-- ProofOfPossession -->
	<element name="ProofOfPossession" type="xkms:ProofOfPossessionType"/>
	<complexType name="ProofOfPossessionType">
		<sequence>
			<element ref="ds:Signature"/>
		</sequence>
	</complexType>
	<!-- /ProofOfPossession -->
	<!-- PrivateKey -->
	<element name="PrivateKey" type="xkms:PrivateKeyType"/>
	<complexType name="PrivateKeyType">
		<sequence>
			<element ref="xenc:EncryptedData"/>
		</sequence>
	</complexType>
	<!-- /PrivateKey -->
	<!-- RegisterRequest -->
	<element name="RegisterRequest" type="xkms:RegisterRequestType"/>
	<complexType name="RegisterRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<sequence>
					<element ref="xkms:PrototypeKeyBinding"/>
					<element ref="xkms:Authentication"/>
					<element ref="xkms:ProofOfPossession" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /RegisterRequest -->
	<!-- RegisterResult -->
	<element name="RegisterResult" type="xkms:RegisterResultType"/>
	<complexType name="RegisterResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<sequence>
					<element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/>
					<element ref="xkms:PrivateKey" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /RegisterResult -->
	<!-- ReissueRequest -->
	<element name="ReissueRequest" type="xkms:ReissueRequestType"/>
	<complexType name="ReissueRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<sequence>
					<element ref="xkms:ReissueKeyBinding"/>
					<element ref="xkms:Authentication"/>
					<element ref="xkms:ProofOfPossession" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<element name="ReissueKeyBinding" type="xkms:KeyBindingType"/>
	<!-- /ReissueRequest -->
	<!-- ReissueResult -->
	<element name="ReissueResult" type="xkms:ReissueResultType"/>
	<complexType name="ReissueResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<sequence>
					<element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /ReissueResult -->
	<!-- RevokeRequest -->
	<element name="RevokeRequest" type="xkms:RevokeRequestType"/>
	<complexType name="RevokeRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<sequence>
					<element ref="xkms:RevokeKeyBinding"/>
					<choice>
						<element ref="xkms:Authentication"/>
						<element ref="xkms:RevocationCode"/>
					</choice>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<element name="RevokeKeyBinding" type="xkms:KeyBindingType"/>
	<!-- /RevokeRequest -->
	<!-- RevocationCode -->
	<element name="RevocationCode" type="xkms:RevocationCodeType"/>
	<simpleType name="RevocationCodeType">
		<restriction base="base64Binary"/>
	</simpleType>
	<!-- /RevocationCode -->
	<!-- RevokeResult -->
	<element name="RevokeResult" type="xkms:RevokeResultType"/>
	<complexType name="RevokeResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<sequence>
					<element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /RevokeResult -->
	<!-- RecoverRequest -->
	<element name="RecoverRequest" type="xkms:RecoverRequestType"/>
	<complexType name="RecoverRequestType">
		<complexContent>
			<extension base="xkms:RequestAbstractType">
				<sequence>
					<element ref="xkms:RecoverKeyBinding"/>
					<element ref="xkms:Authentication"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<element name="RecoverKeyBinding" type="xkms:KeyBindingType"/>
	<!-- /RecoverRequest -->
	<!-- RecoverResult -->
	<element name="RecoverResult" type="xkms:RecoverResultType"/>
	<complexType name="RecoverResultType">
		<complexContent>
			<extension base="xkms:ResultType">
				<sequence>
					<element ref="xkms:KeyBinding" minOccurs="0" maxOccurs="unbounded"/>
					<element ref="xkms:PrivateKey" minOccurs="0"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<!-- /RecoverResult -->
	<!-- RSAKeyPair -->
	<element name="RSAKeyPair" type="xkms:RSAKeyPairType"/>
	<complexType name="RSAKeyPairType">
		<sequence>
			<element ref="xkms:Modulus"/>
			<element ref="xkms:Exponent"/>
			<element ref="xkms:P"/>
			<element ref="xkms:Q"/>
			<element ref="xkms:DP"/>
			<element ref="xkms:DQ"/>
			<element ref="xkms:InverseQ"/>
			<element ref="xkms:D"/>
		</sequence>
	</complexType>
	<element name="Modulus" type="ds:CryptoBinary"/>
	<element name="Exponent" type="ds:CryptoBinary"/>
	<element name="P" type="ds:CryptoBinary"/>
	<element name="Q" type="ds:CryptoBinary"/>
	<element name="DP" type="ds:CryptoBinary"/>
	<element name="DQ" type="ds:CryptoBinary"/>
	<element name="InverseQ" type="ds:CryptoBinary"/>
	<element name="D" type="ds:CryptoBinary"/>
	<!-- /RSAKeyPair -->
	<!-- End Schema -->
</schema>

