Subject: XML for PKIX data structures

From: [email-masked]
Date: Mon, 13 Nov 2000 19:58:58 -0500

This is a rather long message.  It contains a worked example of how XML
might be used in PKIX protocol definitions: a base schema, a sample
protocol, and PDU instance of the protocol.  At the end of the note is
a suggestion for future action.

First is a moderately complete schema definition for "extension"
the (oid,criticality,value) triplet that appears all over the place.
To encourage re-use, it appears as part of "pkix base" schema (that I
just made up).  There are a couple of open issues, search for XXX.

    <xsd:schema
	targetNamespace="http://www.ietf.org/pkix/base"
	xmlns:xsd="http://www.w3.org/2000/10/XMLSchema"
	xmlns:ds="http://www.w3.org/2000/09/xmldsig">

	<xsd:annotation><xsd:documentation>
	    Definition of some base types for IETF PKIX work.
	    XXX Copyright statement goes here.
	</xsd:documentation></xsd:annotation>

	<xsd:simpleType name="oidType">
	    <xsd:annotation><xsd:documentation>
		XXX Are leading zero's allowed in OID's?
	    </xsd:documentation></xsd:annotation>
	    <xsd:restriction base="xsd:string">
		<xsd:pattern value="[1-9][0-9]*(\.[1-9][0-9]*)*"/>
	    </xsd:restriction>
	</xsd:simpleType>

	<xsd:simpleType name="criticalityType">
	    <xsd:annotation><xsd:documentation>
		We define this so that in the future we can allow 0/1,
		t/nil, etc., as false/true values if we want.
	    </xsd:documentation></xsd:annotation>
	    <xsd:restriction base="xsd:boolean"/>
	</xsd:simpleType>

	<xsd:complexType name="extensionbaseType">
	    <xsd:annotation><xsd:documentation>
		This defines the basic extension, an element with three
		attributes -- OID, criticality (defaults to false), and
		an optional name hint.  It can have "data", which is
		base-64 encoded binary data, and/or "content" which is
		XML syntax, representing the value of the extension.
		The semantics are undefined if the two disagree.
	    </xsd:documentation></xsd:annotation>
	    <xsd:attribute name="oid" type="oidType" use="required"/>
	    <xsd:attribute name="criticality" type="criticalityType"
		value="false"/>
	    <xsd:attribute name="name" type="xsd:NMTOKEN"/>
	    <xsd:element name="data" type="ds:CryptoBinary" minOccurs="0"/>
	    <xsd:element name="content" type="xsd:any" minOccurs="0"/>
	</xsd:complexType>

	<xsd:complexType name="extensionlistType">
	    <xsd:element name="ext" type="extensionbaseType"
		minOccurs="0" maxOccurs="unbounded"/>
	</xsd:complexType>

    </xsd:schema>

Whew -- that *is* verbose.  But once we have the definition, using it
isn't too bad.  Here's a fragment for a schema definition for some
PKIX type of operation (enrollment, OCSP, etc).  This defines a request
as having a body (undefined) and then an optional list of extensions:

    <xsd:schema
	targetNamespace="http://www.ietf.org/pkix/sample"
	xmlns:xsd="http://www.w3.org/2000/10/XMLSchema"
	xmlns:pkix="http://www.ietf.org/pkix/base"
	<xsd:element name="Request">
	<xsd:complexType>
	    <xsd:element name="Body" type="..."/>
	    <xsd:element name="Extensions" minOccurs="0"
		type="pkix:extensionlistType"/>
	</xsd:complexType>
    </xsd:schema>

Now, using that schema, here's a sample request (with the body omitted):

    <Request xmlns="http://www.ietf.org/pkix/sample">
	<Body>...</Body>
	<Extensions xmlns="http://www.ietf.org/pkix/base">
	    <ext oid="2.2.840.10040.2.3"/>
	    <ext oid="2.5.29.14" name="id-ce-subjectKeyIdentifier">
		<data>01M3S...</data>
	    </ext>
	</Extensions>
    </Request>

-------------------------------------------

I think it would be useful to define a PKIX "base" schema, and ideally
include a style guide.  That way, if other protocol efforts (such as
SCVP) want to define an XML transport, it will be consistent and avoid
duplication of effort.  I also think it makes sense to do this within
PKIX, analogous to the LDAP et. al operational protocols, or perhaps as
a joint effort with the xmldsig WG.

I'd be happy to start writing an I-D if there's interest.  Any feeling
from the chairs where it should go?
	/r$