<?xml version="1.0" encoding="UTF-8"?>
<!--
  xmldsig11-schema.rnc
  
  Copyright 2011 W3C (Massachusetts Institute of Technology, 
  Institut National de Recherche en Informatique et en Automatique, 
  Keio University). All Rights Reserved.  http://www.w3.org/Consortium/Legal/
  
  Use and distribution of all schemas in this directory are permitted under the terms
  W3C Software Notice and License
  http://www.w3.org/Consortium/Legal/2002/copyright-software-20021231
  
  This schema complements "xmldsig-core-schema.rnc" by 
  introducing elements specific to 1.1.  Note that the definition
  of ds_KeyValueType, ds_KeyInfoChild, and ds_X509DataChild
  in "xmldsig-core-schema.rnc" has been extended so that 
  elements specific to 1.1 are allowed.
-->
<grammar ns="http://www.w3.org/2009/xmldsig11#" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
  <define name="ds_KeyValueType" combine="choice">
    <ref name="dsig11_ECKeyValue"/>
  </define>
  <define name="ds_KeyInfoChild" combine="choice">
    <choice>
      <ref name="dsig11_DEREncodedKeyValue"/>
      <ref name="dsig11_KeyInfoReference"/>
    </choice>
  </define>
  <define name="ds_X509DataChild" combine="choice">
    <choice>
      <ref name="dsig11_OCSPResponse"/>
      <ref name="dsig11_X509Digest"/>
    </choice>
  </define>
  <define name="ds_CanonicalizationMethodType" combine="choice">
    <attribute name="Algorithm">
      <choice>
        <value type="anyURI">http://www.w3.org/2006/12/xml-c14n11</value>
        <value type="anyURI">http://www.w3.org/2006/12/xml-c14n11#WithComments</value>
      </choice>
    </attribute>
  </define>
  <define name="ds_TransformType" combine="choice">
    <attribute name="Algorithm">
      <value type="anyURI">http://www.w3.org/2002/06/xmldsig-filter2</value>
    </attribute>
    <oneOrMore>
      <externalRef href="xmldsig-filter2.rng"/>
    </oneOrMore>
  </define>
  <define name="ds_DigestMethodType" combine="choice">
    <choice>
      <attribute name="Algorithm">
        <value type="anyURI">http://www.w3.org/2001/04/xmlenc#sha256</value>
      </attribute>
      <attribute name="Algorithm">
        <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#sha384</value>
      </attribute>
      <attribute name="Algorithm">
        <value type="anyURI">http://www.w3.org/2001/04/xmlenc#sha512</value>
      </attribute>
    </choice>
  </define>
  <define name="ds_SignatureMethodType" combine="choice">
    <choice>
      <group>
        <attribute name="Algorithm">
          <choice>
            <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#hmac-sha256</value>
            <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#hmac-sha384</value>
            <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#hmac-sha512</value>
          </choice>
        </attribute>
        <optional>
          <element name="HMACOutputLength">
            <ref name="ds_HMACOutputLengthType"/>
          </element>
        </optional>
      </group>
      <attribute name="Algorithm">
        <value type="anyURI">http://www.w3.org/2009/xmldsig11#dsa-sha256</value>
      </attribute>
      <attribute name="Algorithm">
        <choice>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</value>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#rsa-sha384</value>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</value>
        </choice>
      </attribute>
      <attribute name="Algorithm">
        <choice>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</value>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256</value>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384</value>
          <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512</value>
        </choice>
      </attribute>
    </choice>
  </define>
  <define name="dsig11_ECKeyValue">
    <element name="ECKeyValue">
      <ref name="dsig11_ECKeyValueType"/>
    </element>
  </define>
  <define name="dsig11_ECKeyValueType">
    <optional>
      <attribute name="Id">
        <ref name="ds_IdType"/>
      </attribute>
    </optional>
    <choice>
      <element name="ECParameters">
        <ref name="dsig11_ECParametersType"/>
      </element>
      <element name="NamedCurve">
        <ref name="dsig11_NamedCurveType"/>
      </element>
    </choice>
    <element name="PublicKey">
      <ref name="dsig11_ECPointType"/>
    </element>
  </define>
  <define name="dsig11_NamedCurveType">
    <attribute name="URI">
      <data type="anyURI"/>
    </attribute>
  </define>
  <define name="dsig11_ECPointType">
    <ref name="ds_CryptoBinary"/>
  </define>
  <define name="dsig11_ECParametersType">
    <element name="FieldID">
      <ref name="dsig11_FieldIDType"/>
    </element>
    <element name="Curve">
      <ref name="dsig11_CurveType"/>
    </element>
    <element name="Base">
      <ref name="dsig11_ECPointType"/>
    </element>
    <element name="Order">
      <ref name="ds_CryptoBinary"/>
    </element>
    <optional>
      <element name="CoFactor">
        <data type="integer"/>
      </element>
    </optional>
    <optional>
      <element name="ValidationData">
        <ref name="dsig11_ECValidationDataType"/>
      </element>
    </optional>
  </define>
  <define name="dsig11_FieldIDType">
    <choice>
      <ref name="dsig11_Prime"/>
      <ref name="dsig11_TnB"/>
      <ref name="dsig11_PnB"/>
      <ref name="dsig11_GnB"/>
      <ref name="dsig11_OtherFieldIDType"/>
    </choice>
  </define>
  <define name="dsig11_OtherFieldIDType">
    <notAllowed/>
  </define>
  <define name="dsig11_CurveType">
    <element name="A">
      <ref name="ds_CryptoBinary"/>
    </element>
    <element name="B">
      <ref name="ds_CryptoBinary"/>
    </element>
  </define>
  <define name="dsig11_ECValidationDataType">
    <attribute name="hashAlgorithm">
      <data type="anyURI"/>
    </attribute>
    <element name="seed">
      <ref name="ds_CryptoBinary"/>
    </element>
  </define>
  <define name="dsig11_Prime">
    <element name="Prime">
      <ref name="dsig11_PrimeFieldParamsType"/>
    </element>
  </define>
  <define name="dsig11_PrimeFieldParamsType">
    <element name="P">
      <ref name="ds_CryptoBinary"/>
    </element>
  </define>
  <define name="dsig11_GnB">
    <element name="GnB">
      <ref name="dsig11_CharTwoFieldParamsType"/>
    </element>
  </define>
  <define name="dsig11_CharTwoFieldParamsType">
    <element name="M">
      <data type="positiveInteger"/>
    </element>
  </define>
  <define name="dsig11_TnB">
    <element name="TnB">
      <ref name="dsig11_TnBFieldParamsType"/>
    </element>
  </define>
  <define name="dsig11_TnBFieldParamsType">
    <ref name="dsig11_CharTwoFieldParamsType"/>
    <element name="K">
      <data type="positiveInteger"/>
    </element>
  </define>
  <define name="dsig11_PnB">
    <element name="PnB">
      <ref name="dsig11_PnBFieldParamsType"/>
    </element>
  </define>
  <define name="dsig11_PnBFieldParamsType">
    <ref name="dsig11_CharTwoFieldParamsType"/>
    <element name="K1">
      <data type="positiveInteger"/>
    </element>
    <element name="K2">
      <data type="positiveInteger"/>
    </element>
    <element name="K3">
      <data type="positiveInteger"/>
    </element>
  </define>
  <define name="dsig11_OCSPResponse">
    <element name="OCSPResponse">
      <data type="base64Binary"/>
    </element>
  </define>
  <define name="dsig11_DEREncodedKeyValue">
    <element name="DEREncodedKeyValue">
      <ref name="dsig11_DEREncodedKeyValueType"/>
    </element>
  </define>
  <define name="dsig11_DEREncodedKeyValueType">
    <optional>
      <attribute name="Id">
        <ref name="ds_IdType"/>
      </attribute>
    </optional>
    <data type="base64Binary"/>
  </define>
  <define name="dsig11_KeyInfoReference">
    <element name="KeyInfoReference">
      <ref name="dsig11_KeyInfoReferenceType"/>
    </element>
  </define>
  <define name="dsig11_KeyInfoReferenceType">
    <attribute name="URI">
      <data type="anyURI"/>
    </attribute>
    <optional>
      <attribute name="Id">
        <ref name="ds_IdType"/>
      </attribute>
    </optional>
  </define>
  <define name="dsig11_X509Digest">
    <element name="X509Digest">
      <ref name="dsig11_X509DigestType"/>
    </element>
  </define>
  <define name="dsig11_X509DigestType">
    <attribute name="Algorithm">
      <data type="anyURI"/>
    </attribute>
    <data type="base64Binary"/>
  </define>
  <!-- List of known algorithms -->
  <define name="ds_CanonicalizationAlgorithms" combine="choice">
    <choice>
      <value type="anyURI">http://www.w3.org/2006/12/xml-c14n11</value>
      <value type="anyURI">http://www.w3.org/2006/12/xml-c14n11#WithComments</value>
    </choice>
  </define>
  <define name="ds_SignatureAlgorithms" combine="choice">
    <choice>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#hmac-sha256</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#hmac-sha384</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#hmac-sha512</value>
      <value type="anyURI">http://www.w3.org/2009/xmldsig11#dsa-sha256</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#rsa-sha384</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512</value>
    </choice>
  </define>
  <define name="ds_DigestAlgorithms" combine="choice">
    <choice>
      <value type="anyURI">http://www.w3.org/2001/04/xmlenc#sha256</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmldsig-more#sha384</value>
      <value type="anyURI">http://www.w3.org/2001/04/xmlenc#sha512</value>
    </choice>
  </define>
  <define name="ds_TransformAlgorithms" combine="choice">
    <value type="anyURI">http://www.w3.org/2002/06/xmldsig-filter2</value>
  </define>
</grammar>
