- From: Joseph M. Reagle Jr. <reagle@w3.org>
- Date: Mon, 23 Apr 2001 12:10:53 -0400
- To: "XML Encryption WG " <xml-encryption@w3.org>
I've spent some more time playing with the schema and asking questions of Henry. I'm now confident that if we want to use or reuse ds:KeyInfo, my hope to co-exist with its ANY and also show how to do cooler extensibility via subsitutionGroup, or other stronger typing/extensibility isn't easy. The problem is a "non-deterministic content model." For instance, if we say KeyRetrievalMethod is in the subsitution group of RetrievalMethod this means that (1) KeyRetrievalMethod is a restriction/extension of the RetrievalMethod, when it appears in ds:KeyInfo, it should replace RetrievalMethod: they both shouldn't occur. This is very nice. Unfortunately, since there is an ANY in ds:KeyInfo, the validation doesn't know whether to match the KeyRetrievalMethod as a member of the subsitutionGroup or as the ANY, resulting in the "non-deterministic" problem. (I'm using KeyRetrievalMethod as an example of a general extensibility issue, I'm not convinced that we actually need KeyRetrievalMethod, don't see many reasons we couldn't just use ds:RetrievalMethod to do the trick.) Regardless, the only way to get around this would be to redefine the ds:KeyInfo and remove the ANY -- yes, schema permits someone to redefine the schema associated with a namespace in their own context. However, I'm not keen on this. And I don't think it's a good idea to try to remove the ANYs (and use more sophisticated extensions) from dsig at this point. So we're stuck with "orphaned" elements that have to rely upon a comment to get some sense of where they belong: http://www.w3.org/Encryption/2001/04/schema/enc-example.xml <?xml version="1.0" encoding="UTF-8"?> <EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2001/04/xmlenc# 20-xenc-schema.xsd"> <EncryptionMethod Algorithm="foo"/> <ds:KeyInfo> <EncryptedKey xmlns=""> <CipherData>41424344</CipherData></EncryptedKey> <KeyRetrievalMethod URI="http://someKey" Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"/> <ds:KeyName>Joseph</ds:KeyName> </ds:KeyInfo> <CipherData>1234</CipherData> </EncryptedData> http://www.w3.org/Encryption/2001/04/schema/20-xenc-schema.xsd ... <!-- Children of ds:KeyInfo --> <element name="EncryptedKey" type="enc:EncryptedKeyType"/> <complexType name="EncryptedKeyType"> <complexContent> <extension base="enc:EncryptedType"> <sequence> <element ref="enc:ReferenceList" minOccurs="0"/> </sequence> <attribute name="NameKey" type="string" use="optional"/> <attribute name="Recipient" type="string" use="optional"/> </extension> </complexContent> </complexType> <element name="KeyRetrievalMethod" type="enc:KeyRetrievalMethodType" /> <complexType name="KeyRetrievalMethodType"> <complexContent> <restriction base="ds:RetrievalMethodType"> <sequence> <element name="Transforms" type="ds:TransformsType" minOccurs="0"/> </sequence> <attribute name="URI" type="anyURI"/> <attribute name="Type" type="anyURI" use="optional" fixed="http://www.w3.org/2001/04/xmlenc#EncryptedKey" /> </restriction> </complexContent> </complexType> <!-- End Children of ds:KeyInfo --> __ Joseph Reagle Jr. http://www.w3.org/People/Reagle/ W3C Policy Analyst mailto:reagle@w3.org IETF/W3C XML-Signature Co-Chair http://www.w3.org/Signature W3C XML Encryption Chair http://www.w3.org/Encryption/2001/
Received on Monday, 23 April 2001 12:11:06 UTC