ebMS 3.0 PMode Security Type Updates for review

Reused SignatureAlgorithmType and EncryptionAlgorithmType to contain algorithm identifiers and minimum strength indicator. Added more types discussed below. Changed cardinality to make contents optional.

The issue concerning how to indicate elements to be signed, elements to be encrypted, and the order of those operations on elements is not yet here addressed.

I think that we should consider what has been done by WS-SecurityPolicy even though that specification is not yet an approved standard of a SDO. We may wish to at least leave a means of extension to make use of these very detailed security specification assertions

See the public review draft at

http://www.oasis-open.org/committees/download.php/21398/ws-securitypolicy-1.2-spec-ed-01-r12.pdf

For the topic of signed parts and signed elements see section 4.1, Protection Assertions. Data confidentiality is discussed in section 4.2

I did not see any Protection Assertions for attachments so far. Since it is still in public review for a few more days, we could submit a question about how attachment protection is indicated.

I also am looking for how the ordering is agreed upon. My guess at the moment is that ordering is left to the actual WSS header to convey.

<xsd:complexType name="PModeSecurityType">

<xsd:annotation>

<xsd:documentation/>

</xsd:annotation>

<xsd:sequence>

<xsd:element name="UsernameToken" minOccurs="0" type="tns:UserNameTokenType"/>

<xsd:element name="EncryptionCertificate" minOccurs="0" maxOccurs="unbounded"

type="tns:CertificateUnionType"/>

<xsd:element name="SignatureCertificate" minOccurs="0" maxOccurs="unbounded"

type="tns:CertificateUnionType"/>

<xsd:element name="Signature" minOccurs="0" type="tns:SignatureAlgorithmType"/>

<xsd:element name="Encryption" minOccurs="0" type="tns:EncryptionAlgorithmType"/>

</xsd:sequence>

<xsd:attribute name="wssVersion" type="xsd:string"/>

<xsd:attribute name="authorize" type="xsd:boolean"/>

<xsd:attribute name="created" type="xsd:boolean"/>

<xsd:attribute name="nonce" type="xsd:boolean"/>

<xsd:attribute name="digest" type="xsd:boolean"/>

</xsd:complexType>

Reassembled existing CPA types to allow either direct inclusion of Certificate or use of a reference to point to a certificate contained in the document.

<xsd:complexType name="CertificateUnionType">

<xsd:sequence>

<xsd:choice>

<xsd:element ref="ds:KeyInfo"/>

<xsd:element ref="tns:CertificateRef"/>

</xsd:choice>

</xsd:sequence>

<xsd:anyAttribute processContents="lax" namespace="##any" />

</xsd:complexType>

Added a UserNameTokenType subtype. The choice should allow the appearance of encrypted UserNameTokenTypes and other namespace definitions of security tokens.

<xsd:complexType name="UserNameTokenType">

<xsd:annotation>

<xsd:documentation/>

</xsd:annotation>

<xsd:choice>

<xsd:sequence>

<xsd:element name="UserName" minOccurs="0"/>

<xsd:element name="SecurityToken"/>

</xsd:sequence>

<xsd:sequence>

<xsd:any minOccurs="1" maxOccurs="unbounded" namespace="##other"

processContents="lax"/>

</xsd:sequence>

</xsd:choice>

</xsd:complexType>

ebxml-msg message