XML Security Working Group Teleconference
10 Aug 2010

Administrative

<fjh> Hal will scribe next week

<fjh> Reminder TPAC questionnaire and registration

Minutes approval

<fjh> Approve 3 August 2010 minutes

<fjh> http://www.w3.org/2010/08/03-xmlsec-minutes.html

RESOLUTION: Minutes from 3 August 2010 approved.

Elliptic Curve

member-only summary of this discussion prepared by W3 team is available.

<fjh> http://lists.w3.org/Archives/Member/member-xmlsec/2010Aug/0007.html

<fjh> w3c patent policy - http://www.w3.org/Consortium/Patent-Policy-20040205/#sec-Requirements

<fjh> 6. may be suspended with respect to any licensee when licensor is sued by licensee for infringement of claims essential to implement any W3C Recommendation;

<fjh> http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential

<fjh> "Essential Claims" shall mean all claims in any patent or patent application in any jurisdiction in the world that would necessarily be infringed by implementation of the Recommendation. A claim is necessarily infringed hereunder only when it is not possible to avoid infringing it because there is no non-infringing alternative for implementing the normative portions of the Recommendation. Existence of a non-infringing alternative shall be judged based on the state of

<fjh> art at the time the specification becomes a Recommendation.

<fjh> Hal asks if normative but optional portion of specification is essential

<fjh> Different conformance clauses can require different optional portions, no?

<rigo> http://www.w3.org/TR/2003/WD-patent-policy-20030319/#def-essential-requirements

<fjh> http://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential-requirements

<fjh> For purposes of this definition, the normative portions of the Recommendation shall be deemed to include only architectural and interoperability requirements. Optional features in the RFC 2119 [KEYWORDS] sense are considered normative unless they are specifically identified as informative. Implementation examples or any other material that merely illustrate the requirements of the Recommendation are informative, rather than normative.

<tlr> ACTION: thomas to propose ECC-related refactoring of spec [recorded in http://www.w3.org/2010/08/10-xmlsec-minutes.html#action01]

<trackbot> Created ACTION-621 - Propose ECC-related refactoring of spec [on Thomas Roessler - due 2010-08-17].

Last Call Comments

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0012.html

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0016.html

<tlr> http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0012.html

<tlr> http://www.w3.org/2006/02/lc-comments-tracker/42458/WD-xmlenc-core1-20100513/2386

<tlr> http://www.w3.org/2006/02/lc-comments-tracker/42458/WD-xmlenc-core1-20100513/2387

<tlr> ACTION: thomas to propose wording for response to EXI WG on LC-2386 LC-2387 [recorded in http://www.w3.org/2010/08/10-xmlsec-minutes.html#action02]

<trackbot> Created ACTION-622 - Propose wording for response to EXI WG on LC-2386 LC-2387 [on Thomas Roessler - due 2010-08-17].

RESOLUTION: Accept Thomas' proposal in http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0012.html

Schemas

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0005.html

<fjh> http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0017.html

<fjh> ACTION-600?

<trackbot> ACTION-600 -- Thomas Roessler to draft proposal of how update to 1.0 schema will work practically for existing implementations -- due 2010-08-10 -- PENDINGREVIEW

<trackbot> http://www.w3.org/2008/xmlsec/track/actions/600

<fjh> proposed RESOLUTION: WG agrees the 1.0 schema changes the type on X509SerialNumber from Integer to String. Make corresponding changes to version 1.1 of the specification; include the updated schema in the 1.1 publication.

<fjh> proposed RESOLUTION: WG accepts schema update plan per http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0017.html

<fjh> magnus asks how this will work with old implementations after change, wants more time to investigate

<tlr> +1 to best practices

<csolc> +1

<brich>scott suggests update best practice to not pull schema at runtime

<fjh> ACTION: magnus to review schema update plan, http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0017.html [recorded in http://www.w3.org/2010/08/10-xmlsec-minutes.html#action03]

<trackbot> Created ACTION-623 - Review schema update plan, http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0017.html [on Magnus Nystrom - due 2010-08-17].

<tlr> action-623 due 2010-08-25

<trackbot> ACTION-623 Review schema update plan, http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0017.html due date now 2010-08-25

<fjh> what would happen to existing implementations that use integer with schema changed to string

<fjh> tlr notes possible concern with schema aware EXI

<tlr> tlr: please consider what happens if we (a) update the schema that sits at the namespace URI, and (b) replace it with an XHTML document that points at a new schema

<brich> Brian notes issue with object models that build off the schema

<brich> Brian notes that the on-the-wire format is not changing, object model can change locally, do we now ship the new schema, refer to new schema, how to communicate both within and without the toolsets

<brich> scantor: concern that errors in schema are not being addressed, need to balance interop with correctness

<brich> bal: published a schema for 1.0, would prefer updated schema for 1.0 with new URI

<brich> scantor: still need what the best practice should be to make recommendation

<brich> tlr: not going through errata process, as the spec update process will effectively perform a schema update

Canonical XML 2.0

qnameAware parameter

http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0009.html

http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0010.html

http://lists.w3.org/Archives/Public/public-xmlsec/2010Aug/0013.html

pratik asked in email: I also think we should change the "Element" to maybe "QNElement" or how about "QNameInText" ?

<brich> scantor: wrestling with conciseness vs explicit expression

<brich> scantor: important to express elements, qualified attributes, unqualified attributes...would like a term to refer to all 3

<brich> scantor: not in favor of #2, due to capitalization issues in various editors

<brich> scantor: perhaps need additional input from group? more think time? get feedback?

<brich> fjh: Need addl review

<brich> fjh: Add to draft

XPath Profile

Removing id function - id()

id function will only work if ID defined in DTD

from minutes - http://www.w3.org/2010/07/06-xmlsec-minutes.html#item06

<brich> scantor: IDness is a streaming issue

document - http://www.w3.org/2008/xmlsec/Drafts/xmldsig-xpath/#sec-definition

<brich> scantor: relative vs absolute XPath

<brich> scantor: would use ID in referenced in enveloped signatures

scantor notes could still have id for Reference but not for XPath

<brich> pdatta: XPath ID seems to be tied to DTD IDs

<Ed_Simon> Maybe fjh was thinking of the concern I had wrt to referencing <Object> element content; I think that is mainly a separate issue.

<brich> scantor: DOM tells me its an ID, but the DTD doesn't = excluded?

<brich> scantor: DOM is used to resolve IDs, not URIResolvers?

<brich> meiko: looking at XPath reference, do see issues with streamability, may need to exclude from streaming profile

proposed RESOLUTION: remove id() from Streamable XPath Profile

<brich> scantor: does streaming always imply one-pass?

<brich> pdatta: no, may not be one-pass