Re: [xri] subject sets (also sort of: Agenda for August 6, 2009 call)

[Nat Sakimura <n-sakimura@nri.co.jp>]

Looks like I did not attache it properly...

Here it is.

=nat

Sakimura Nat wrote:

4A800616.3040405@nri.co.jp" type="cite"> Will,

Since I do not seem to have commit privilege, I am attaching my edit here.

Following is the change that I made.

Promoted 4.3 XRD Signature to 4. XRD Signature.
Moved 4.1 Subject Matching to 3.4 Subject Matching.
Changed 4. XRD Trust to 5. XRD Trust, and removed a section. In 5. XRD Trust, removed text and added a text to say that this should be application specific.

It is just as Eran indicated, but I did not remove the Trust section in its entirety, as I thought it would be useful to keep it as a stab so that application protocol designers can see that they should profile XRD 1.0.

=nat

Eran Hammer-Lahav wrote:

90C41DD21FB7C64BB94121FBBC2E72343783605EB8@P3PW5EX1MB01.EX1.SECURESERVER.NET" type="cite">

We are in complete agreement.

This means we need to move 4.3 (XRD Signature) to its own top section (following 3).

Also, we should move 4.1 (Subject Matching) into section 3 because XRD/Link/Subject is undefined for any other use case at this point.

And get rid of the rest of the trust section...

EHL

  

-----Original Message-----
From: John Bradley [mailto:jbradley@mac.com]
Sent: Saturday, August 08, 2009 11:37 PM
To: Eran Hammer-Lahav
Cc: Scott Cantor; 'Will Norris'; 'XRI TC'
Subject: Re: [xri] subject sets (also sort of: Agenda for August 6,
2009 call)

OK,

XRD needs to specify how XRD's are signed from a XML perspective.

However the XRD spec should not be mandating the relationships between
the the signatures and the subject.

If they are used for XRI resolution the application may not be using
the CN from the certificate in the signature to match against the
Subject of the XRD.

If SAML were to use XRD meta-data in conjunction with SAML meta-data I
could see quite a different trust model event though it would be using
LRDD + XRD.

I think the trust model we are talking about is one that specifically
relates to the LRDD + XRD use case for  openID and oAuth where people
want to use conventional CA based PKI.

This will be the most common use case but is not the only one.

I think Scott and I are just saying that the core XRD spec should not
preclude other trust models.

I think Scott was suggesting keeping the core spec generic and
producing profiles for the different use cases.   Somewhat like SAML.

The fine points of requiring RSA vs ECDSA, SHA1 vs SHA256 Keyinfo vs
KeyData ,  as well as what needs to be verified and how need to be in
a doc with a conformance requirement.

Perhaps that is what you are saying as well.

Scott feel free to correct if I misinterpreted what you were getting
at.

John B.

On 8-Aug-09, at 10:17 PM, Eran Hammer-Lahav wrote:

    

LRDD is not going to touch trust. It is a generic method for
associating a resource with a description. One of its methods
include an XRD document about the host. That too will not touch
trust. The whole point was for something else (i.e. XRD) to define
the exact steps a client can perform to validate trust if it is
provided and it so desired.

I don't know how to translate what you are suggesting into what the
spec is going to offer.

I was under the impression that all this was done. If we are still
discussing trust related issues, as this seems to suggest, I would
like to immediately split that whole section off and move forward
without it, with trust being published as a separate spec.

We are going in circles.

EHL

      

-----Original Message-----
From: John Bradley [mailto:jbradley@mac.com]
Sent: Saturday, August 08, 2009 2:20 PM
To: Scott Cantor
Cc: Eran Hammer-Lahav; 'Will Norris'; 'XRI TC'
Subject: Re: [xri] subject sets (also sort of: Agenda for August 6,
2009 call)

Tying the authority segment of the subject to the CN of the signing
cert is a trust model that works for LRDD.   It won't work for XRI
        

or
    

other things that may use XRD.

We do need a complete solution for LRDD but it shouldn't preclude
other trust models for XRD.

John B.
On 8-Aug-09, at 1:32 PM, Scott Cantor wrote:

        

Eran Hammer-Lahav wrote on 2009-08-08:
          

That's what we set to do. If the trust section does not provide
this as a
complete solution, it is pointless.
            

I'm not trying to prevent your complete solution, I'm just talking
about how
it should be structured as a matter of spec design.

There can't be *one* trust model for XRD. That's never going to
          

fly.
    

There
are obvious points of flexibility, and anywhere you start
          

connecting
    

XRD to
something like X.509, that's got to be pretty adapatable. If you
need to
profile it down for particular use cases (e.g. requiring self-
assertion),
then that can be included, and even required for conformance
          

purposes.
        

-- Scott



-------------------------------------------------------------------
          

--
    

To unsubscribe from this mail list, you must leave the OASIS TC
          

that
    

generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-
          

open.org/apps/org/workgroup/portal/my_workgroups.php
        

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-
      

open.org/apps/org/workgroup/portal/my_workgroups.php
    

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

  

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE article
  PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
         "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd"; 
[
<!--the document properties-->
<!ENTITY name "xrd">
<!ENTITY version "1.0">
<!ENTITY standard "Working Draft">
<!ENTITY stage "wd">
<!ENTITY stagenumber "03">
<!ENTITY prevstagenumber "02">
<!ENTITY pubdate "04 August 2009">

<!ENTITY baseurl "http://docs.oasis-open.org/xri/&name;/v&version;";>
<!ENTITY filename "&name;-&version;">
<!ENTITY versionfilename "&filename;-&stage;&stagenumber;">
]>
<article status="&standard;">

<articleinfo>
	<productname>&name;</productname>
	<productnumber>&version;</productnumber>
	<releaseinfo role="stage">&stage;</releaseinfo>
	<pubsnumber>&stagenumber;</pubsnumber>

	<releaseinfo role="product"><ulink url="&name;-&version;.xml">XML</ulink></releaseinfo>
	<releaseinfo role="product"><ulink url="&name;-&version;.html">HTML</ulink></releaseinfo>
	<releaseinfo role="product"><ulink url="&name;-&version;.pdf">PDF</ulink></releaseinfo>

	<releaseinfo role="location-persistent_version">&baseurl;/&filename;.html</releaseinfo>
	<releaseinfo role="location-current_version">&baseurl;/WD&stagenumber;/&versionfilename;.html</releaseinfo>
	<releaseinfo role="location-previous_version">&baseurl;/WD&prevstagenumber;/&filename;-wd&prevstagenumber;.html</releaseinfo>

	<releaseinfo role="committee">OASIS eXtensible Resource Identifier (XRI) TC</releaseinfo>

	<title>Extensible Resource Descriptor (XRD) Version 1.0</title>

	<authorgroup>
		<othercredit>
			<firstname>Peter</firstname><surname>Davis</surname>
			<affiliation>
				<orgname>NeuStar Inc.</orgname>
			</affiliation>
		</othercredit>
		<othercredit>
			<firstname>Drummond</firstname><surname>Reed</surname>
			<affiliation>
				<orgname>Cordance</orgname>
			</affiliation>
		</othercredit>
		<editor>
			<firstname>Eran</firstname><surname>Hammer-Lahav</surname>
			<affiliation>
				<orgname>Yahoo!</orgname>
			</affiliation>
		</editor>
		<editor>
			<firstname>Will</firstname><surname>Norris</surname>
			<affiliation>
				<orgname>Internet2</orgname>
			</affiliation>
		</editor>
	</authorgroup>

	<pubdate>&pubdate;</pubdate>

	<copyright>
		<year>2009</year>
		<holder>OASIS Open, Inc. All Rights Reserved.</holder>
	</copyright>

	<legalnotice role="related">
		<title>Related Work</title>

		<para>This specification replaces or supersedes:</para>
		<itemizedlist spacing="compact">
			<listitem>
				<para>Extensible Resource Identifier (XRI) Resolution Version 2.0, Committee Draft 03, February 2008</para>
			</listitem>
		</itemizedlist>

		<para>This specification is related to:</para>
		<itemizedlist spacing="compact">
			<listitem>
				<para>Extensible Resource Identifier (XRI) Version 3.0, Committee Draft 01, May 2009</para>
			</listitem>
		</itemizedlist>
	</legalnotice>

	<legalnotice role="namespaces">
		<title>Declared XML Namespace</title>
		<itemizedlist spacing="compact">
			<listitem>
				<para>http://docs.oasis-open.org/ns/xri/xrd-1.0</para>
			</listitem>
		</itemizedlist>
	</legalnotice>

	<abstract>
		<para>This document defines XRD, a simple generic format for describing resources.</para>
	</abstract>

	<legalnotice role="status">
		<title>Status</title>

		<para>This document was last revised or approved by the XRI Technical Committee on the above date. The level of 
			approval is also listed above. Check the current location noted above for possible later revisions of this 
			document. This document is updated periodically on no particular schedule.</para>
		<para>Technical Committee members should send comments on this specification to the Technical Committee's email 
			list. Others should send comments to the Technical Committee by using the "Send A Comment" button on the 
			Technical Committee's web page at <ulink url="http://www.oasis-open.org/committees/xri";>
			<literal>http://www.oasis-open.org/committees/xri</literal></ulink>.</para>
		<para>For information on whether any patents have been disclosed that may be essential to implementing this 
			specification, and any offers of patent licensing terms, please refer to the Intellectual Property Rights 
			section of the Technical Committee web page (<ulink url="http://www.oasis-open.org/committees/xri/ipr.php";>
			<literal>http://www.oasis-open.org/committees/xri/ipr.php</literal></ulink>).</para>
		<para>The non-normative errata page for this specification is located at <ulink url="http://www.oasis-open.org/committees/xri";>
			<literal>http://www.oasis-open.org/committees/xri</literal></ulink>.</para>
	</legalnotice>

	<legalnotice role="notices">
		<title>Notices</title>

		<para>Copyright &#169; OASIS Open 2005. All Rights Reserved.</para>
		<para>All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property 
			Rights Policy (the "OASIS IPR Policy"). The full Policy may be found at the OASIS website.</para>
		<para>This document and translations of it may be copied and furnished to others, and derivative works that comment on 
			or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in 
			whole or in part, without restriction of any kind, provided that the above copyright notice and this section are 
			included on all such copies and derivative works. However, this document itself may not be modified in any way, 
			including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing 
			any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to 
			copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages 
			other than English.</para>
		<para>The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.</para>
		<para>This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL 
			WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN 
			WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR 
			PURPOSE.</para>
		<para>OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily 
			be infringed by implementations of this OASIS Committee Specification or OASIS Standard, to notify OASIS TC 
			Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a 
			manner consistent with the IPR Mode of the OASIS Technical Committee that produced this specification.</para>
		<para>OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any 
			patent claims that would necessarily be infringed by implementations of this specification by a patent holder that 
			is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS 
			Technical Committee that produced this specification. OASIS may include such claims on its website, but disclaims 
			any obligation to do so.</para>
		<para>OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be 
			claimed to pertain to the implementation or use of the technology described in this document or the extent to which 
			any license under such rights might or might not be available; neither does it represent that it has made any effort 
			to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable 
			produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available 
			for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a 
			general license or permission for the use of such proprietary rights by implementers or users of this OASIS Committee 
			Specification or OASIS Standard, can be obtained from the OASIS TC Administrator. OASIS makes no representation that 
			any information or list of intellectual property rights will at any time be complete, or that any claims in such list 
			are, in fact, Essential Claims.</para>
	</legalnotice>
</articleinfo>

<section id="s.introduction">
	<title>Introduction</title>

	<para>
		This document defines XRD, a simple generic format for describing resources.  Resource descriptor documents provide 
		machine-readable information about resources (resource metadata) for the purpose of promoting 
		interoperability and assist in interacting with unknown resources that support known interfaces.
	</para>

	<para>
		For example, a web page about an upcoming meeting can provide in its descriptor document the location 
		of the meeting organizer's free/busy information to potentially negotiate a different time.  The descriptor 
		for a social network profile page can identify the location of the user's address book as well as accounts 
		on other sites.  A web service implementing an API with optional components can advertise which of these 
		are supported.
	</para>

	<section id="s.terminology">
		<title>Terminology</title>

		<para>
			The key words <glossterm>must</glossterm>, <glossterm>must not</glossterm>, <glossterm>required</glossterm>,
			<glossterm>shall</glossterm>, <glossterm>shall not</glossterm>, <glossterm>should</glossterm>, 
			<glossterm>should not</glossterm>, <glossterm>recommended</glossterm>, <glossterm>may</glossterm>, and 
			<glossterm>optional</glossterm> in this document are to be interpreted as described in <xref linkend="rfc2119"/>.
		</para>
	</section>

</section>

<section id="s.document.structure">
	<title>XRD Document Structure</title>

	<para>
		XRD provides a simple and extensible XML format for describing resources. An XRD document describes the 
		properties of the resource itself, as well as the relationship the resource has with other resources. 
		XRD builds directly on the typed link relations framework used by <xref linkend="link-header" />, HTML, 
		Atom, and other protocols.
	</para>

	<para>
		The XRD schema defines only the basic elements necessary to support the most common use cases, with the 
		explicit intention that applications will extend XRD as defined in <xref linkend="s.section.extensibility" />
		to include any other metadata about the resources they describe.  
	</para>

	<section id="s.xrd.namespace">
		<title>Namespace and Schema Location</title>

		<para>
			The following <xref linkend="relaxng-compact" /> schema fragment defines the XML namespaces and other 
			header information for the XRD schema:

			<programlisting>default namespace = "http://docs.oasis-open.org/ns/xri/xrd-1.0";
namespace xrd = "http://docs.oasis-open.org/ns/xri/xrd-1.0";
namespace xml = "http://www.w3.org/XML/1998/namespace";
datatypes xs = "http://www.w3.org/2001/XMLSchema-datatypes";

include "http://www.w3.org/2007/xmlsec/Drafts/xmldsig-rngschema/xmldsig-core-schema.rnc";

start = XRD

anyelementbody =
    (attribute * {text}
    | text
    | element * { anyelementbody } )*

non.xrd.element = element * - xrd:* {
    anyelementbody
}

other.attribute = attribute * - xrd:* { text }</programlisting>
		</para>

		<para>
			The location of the normative RELAX NG schema file for an XRD document as defined by this specification is: 
			<ulink url="&baseurl;/WD&stagenumber;/&versionfilename;.rnc"><literal>&baseurl;/WD&stagenumber;/&versionfilename;.rnc</literal></ulink>
		</para>

		<para>
			The following URI will always reference the latest version of this file: 
			<ulink url="&baseurl;/&name;-&version;.rnc"><literal>&baseurl;/&filename;.rnc</literal></ulink>
		</para>
	</section>

	<section id="s.document.properties">
		<title>Document Property Elements</title>

		<para>
			XRD defines a few elements used to describe the properties of the XRD document itself. These elements describe 
			what the document is about and provide administrative information as to how the information should be cached. 
			In addition, XRD defines elements used to verify the authenticity of the document for the purpose of establishing 
			trust and authority.
		</para>

		<section id="s.element.xrd">
			<title>Element <sgmltag class="starttag">XRD</sgmltag></title>
			<para>
				The <sgmltag class="starttag">XRD</sgmltag> element encapsulates the entire resource descriptor, and is most 
				commonly the root element of the document. It contains the following attributes and elements:

				<variablelist spacing="compact">

					<varlistentry>
						<term><sgmltag class="attribute">xml:id</sgmltag> [Optional]</term>
						<listitem>
							<para>
								This attribute, of type <sgmltag class="attvalue">xs:ID</sgmltag>, is defined by 
								<xref linkend="xml-id" />.  It provies a unique identifier for this XRD.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Expires</sgmltag> [Zero or One]</term>
						<listitem>
							<para>
								Specifies when this document expires, as described in <xref linkend="s.element.expires" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Subject</sgmltag> [Zero or One]</term>
						<listitem>
							<para>
								Provides the canonical identifier for the resource described by this XRD.  When
								<sgmltag class="starttag">Subject</sgmltag> appears as a child element of 
								<sgmltag class="starttag">XRD</sgmltag>, it identifies the resource the XRD document 
								is about.  See <xref linkend="s.element.subject" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Alias</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Provides an additional identifier for the resoure described by this XRD.  See 
								<xref linkend="s.element.alias" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Type</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Declares a property of the resource described by this XRD.  See <xref linkend="s.element.type" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Link</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Identifies another resource which is related to the resource described by this XRD, and describes 
								the semantics of that relationship.  See <xref linkend="s.element.link" />.
							</para>
						</listitem>
					</varlistentry>
					
					<varlistentry>
						<term><sgmltag class="starttag">ds:Signature</sgmltag> [Zero or One]</term>
						<listitem>
							<para>
								This is an XML Signature, included from the <xref linkend="xml-sig" /> schema, that protects 
								the integrity of the document, as described in <xref linkend="s.section.signature" />.
							</para>
						</listitem>
					</varlistentry>

				</variablelist>
			</para>

			<para>The following schema fragment defines the <sgmltag class="starttag">XRD</sgmltag> element:
				 <programlisting>XRD = element XRD {
    attribute xml:id { xs:ID } ?,
    other.attribute *,
    Expires ?,
    Subject ?,
    ( Alias | Type | Link | non.xrd.elemnt ) *,
    Signature ?
}</programlisting>
			</para>
		</section>

		<section id="s.element.expires">
			<title>Element <sgmltag class="starttag">Expires</sgmltag></title>
			<para>
				This <sgmltag class="attvalue">xs:dateTime</sgmltag> value indicates the time instant after which the 
				document is no longer valid and <glossterm>must not</glossterm> be used.  The value 
				<glossterm>must</glossterm> use the UTC "Z" time zone and <glossterm>must not</glossterm> use 
				fractional seconds.  In addition to this explicit expiration instant of the document, XRD consuming 
				applications <glossterm>should</glossterm> comply with the caching rules of the transport protocol 
				used to retrieve the XRD.
			</para>
			<para>The following schema fragment defines the <sgmltag class="starttag">Expires</sgmltag> element:
				<programlisting>Expires = element Expires {
    other.attribute *,
    xs:dateTime
}</programlisting>
			</para>
		</section>

		<section id="s.element.subject">
			<title>Element <sgmltag class="starttag">Subject</sgmltag></title>
			<para>
				<sgmltag class="starttag">Subject</sgmltag> is a <sgmltag class="attvalue">xs:anyURI</sgmltag> value 
				which identifies a resource.  This value <glossterm>must</glossterm> be an absolute URI.  
				<sgmltag class="starttag">Subject</sgmltag> contains the following attributes:

				<variablelist spacing="compact">
					<varlistentry>
						<term><sgmltag class="attribute">match</sgmltag> [Optional]</term>
						<listitem>
							<para>
								The <sgmltag class="attribute">match</sgmltag> attribute, of type 
								<sgmltag class="attvalue">xs:anyURI</sgmltag>, is used to indicate the rules which 
								should be used when matching this <sgmltag class="starttag">Subject</sgmltag> to 
								another URI.  See <xref linkend="s.subject.matching" />.
							</para>
						</listitem>
					</varlistentry>
				</variablelist>

			</para>

			<para>The following schema fragment defines the <sgmltag class="starttag">Subject</sgmltag> element:
				<programlisting>Subject = element Subject {
    other.attribute *,
    xs:anyURI
}</programlisting>
			</para>
		</section>

	</section>

	<section id="s.resource.properties">
		<title>Resource Property Elements</title>

		<para>
			These elements provide information and attributes about the resource that the XRD document is describing.
		</para>

		<section id="s.element.alias">
			<title>Element <sgmltag class="starttag">Alias</sgmltag></title>
			<para>
				This <sgmltag class="attvalue">xs:anyURI</sgmltag> value provides an additional non-canonical identifier
				for the resource described by the XRD.  This value <glossterm>must</glossterm> be an absolute URI.
			</para>
			<para>The following schema fragment defines the <sgmltag class="starttag">Alias</sgmltag> element:
				 <programlisting>Alias = element Alias {
    other.attribute *,
    xs:anyURI
}</programlisting>
			</para>
		</section>

		<section id="s.element.type">
			<title>Element <sgmltag class="starttag">Type</sgmltag></title>
			<para>
				The <sgmltag class="starttag">Type</sgmltag> element, of type 
				<sgmltag class="attvalue">xs:anyURI</sgmltag>, declares a property of the resource described by the 
				XRD.  The meaning of the <sgmltag class="starttag">Type</sgmltag> value is application-specific, and 
				is used by the XRD publisher to describe the resource to consuming applications familiar with the 
				type identifier.  <sgmltag class="starttag">Type</sgmltag> contains the following attributes:

				<variablelist spacing="compact">
					<varlistentry>
						<term><sgmltag class="attribute">required</sgmltag> [Optional]</term>
						<listitem>
							<para>
								The <sgmltag class="attribute">required</sgmltag> attribute, of type 
								<sgmltag class="attvalue">xs:boolean</sgmltag>, is used to indicate to a consuming 
								application that some pre-defined knowledge is required in order to interact with the 
								resource, without which undefined or potentially harmful side-effects can occur. 
							</para>
							<para>
								If the <sgmltag class="attribute">required</sgmltag> attribute is omitted or 
								explicitly set to <sgmltag class="attvalue">false</sgmltag>, a consuming application 
								<glossterm>should</glossterm> ignore any <sgmltag class="starttag">Type</sgmltag> with 
								values it does not recognize, and interact with the resource based on the values it 
								does recognize.  If the <sgmltag class="attribute">required</sgmltag> attribute is set 
								to <sgmltag class="attvalue">true</sgmltag>, a consuming application 
								<glossterm>must not</glossterm> interact with the resource if it does not recognize 
								the type identifier.  The <sgmltag class="attribute">required</sgmltag> attribute 
								<glossterm>should not</glossterm> be used unless such harmful side-effects are likely.
							</para>
						</listitem>
					</varlistentry>

				</variablelist>
			</para>
			<para>The following schema fragment defines the <sgmltag class="starttag">Type</sgmltag> element:
				 <programlisting>Type = element Type {
    attribute required { xs:boolean } ?,
    other.attribute *,
    xs:anyURI
}</programlisting>
			</para>
		</section>

	</section>

	<section id="s.related.resources">
		<title>Related Resource Elements</title>

		<para>
			One of the primary uses of XRD is to describe the relationship between different resources.  The following 
			elements identify and describe the other resources which are related to the resource the XRD document is 
			describing.
		</para>

		<section id="s.element.link">
			<title>Element <sgmltag class="starttag">Link</sgmltag></title>
			<para>
				The <sgmltag class="starttag">Link</sgmltag> element serves as a container for metadata about the related 
				resource, and carries similar semantics as the HTML Link element, the ATOM Link element, and the HTTP Link 
				Header.  The one distinction is that link relationships described by the 
				<sgmltag class="starttag">Link</sgmltag> element are between the resource described by the XRD and the 
				linked resources, and not between the XRD itself and the linked resource.  
				<sgmltag class="starttag">Link</sgmltag> has the following elements and attributes:

				<variablelist spacing="compact">

					<varlistentry>
						<term><sgmltag class="attribute">priority</sgmltag> [Optional]</term>
						<listitem>
							<para>
								The <sgmltag class="attribute">priority</sgmltag> attribute is of type 
								<sgmltag class="attvalue">xs:nonNegativeInteger</sgmltag>.  See 
								<xref linkend="s.priority.attribute" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Subject</sgmltag> [Zero or One]</term>
						<listitem>
							<para>
								When <sgmltag class="starttag">Subject</sgmltag> appears as a child element of a 
								<sgmltag class="starttag">Link</sgmltag>, it identifies the linked resource.  This 
								asserts the value that should be expected for the 
								<sgmltag class="starttag">Subject</sgmltag> in the linked XRD.  Use of this element 
								in establishing trust can be found in <xref linkend="s.section.trust" />.  For the 
								syntax of this element, see <xref linkend="s.element.subject" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">Rel</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Defines the semantics of the link relationship.  See <xref linkend="s.element.rel" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">MediaType</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Provides a hint at the media type of the linked resource. See <xref linkend="s.element.mediaType" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">URI</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Identifies how the linked resource can be retrieved.  See <xref linkend="s.element.uri" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">URITemplate</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								Provides a template which can be used to obtain a URI for retrieving the resource.  See 
								<xref linkend="s.element.uriTemplate" />.
							</para>
						</listitem>
					</varlistentry>

					<varlistentry>
						<term><sgmltag class="starttag">ds:KeyInfo</sgmltag> [Zero or More]</term>
						<listitem>
							<para>
								KeyInfo is included from the <xref linkend="xml-sig" /> schema, and provides the digital 
								signature metadata necessary to validate interaction with the linked resource.  See 
								<xref linkend="s.section.trust" />.
							</para>
						</listitem>
					</varlistentry>

				</variablelist>
			</para>
			<para>The following schema fragment defines the <sgmltag class="starttag">Link</sgmltag> element:
				 <programlisting>Link = element Link {
    attribute priority { xs:nonNegativeInteger } ?,
    other.attribute *,
    Subject ?,
    ( Rel | MediaType | URI | URITemplate | KeyInfo | non.xrd.element ) *
}</programlisting>
			</para>
		</section>

		<section id="s.element.rel">
			<title>Element <sgmltag class="starttag">Rel</sgmltag></title>
			<para>
				This <sgmltag class="attvalue">xs:anyURI</sgmltag> value defines the semantics of the relationship 
				between the resource described by the XRD and the linked resource.  
				<sgmltag class="starttag">Rel</sgmltag> is semantically equivalent to the Link Relationship Types 
				defined in <xref linkend="link-header" />.  It is important to note that this value does not 
				identify any property of the linked resource.  Rather, it describes only how the linked resource is 
				related to the resource described by the XRD.
			</para>
			<para>The following schema fragment defines the <sgmltag class="starttag">Rel</sgmltag> element:
				 <programlisting>Rel = element Rel {
    other.attribute *,
    xs:anyURI
}</programlisting>
			</para>
		</section>

		<section id="s.element.mediaType">
			<title>Element <sgmltag class="starttag">MediaType</sgmltag></title>
			<para>
				This <sgmltag class="attvalue">xs:string</sgmltag> value provides a hint as to the media type of the 
				linked resource.  The value of this element <glossterm>must</glossterm> be of the form of a media 
				type defined in <xref linkend="rfc2046" />.  The IANA media types registry can be found at 
				<ulink url="http://www.iana.org/assignments/media-types/"; />.
			</para>
			<para>The following schema fragment defines the <sgmltag class="starttag">MediaType</sgmltag> element:
				 <programlisting>MediaType = element MediaType {
    other.attribute *,
    xs:string
}</programlisting>
			</para>
		</section>

		<section id="s.element.uri">
			<title>Element <sgmltag class="starttag">URI</sgmltag></title>
			<para>
				<sgmltag class="starttag">URI</sgmltag> is a <sgmltag class="attvalue">xs:anyURI</sgmltag> value that 
				provides the URI where the linked resource can be found and used or retrieved. If no URI element is 
				defined, it is assumed the URI can be obtained by other means not specified in this specification.
				<sgmltag class="starttag">URI</sgmltag> has the following attributes:

				<variablelist spacing="compact">
					<varlistentry>
						<term><sgmltag class="attribute">priority</sgmltag> [Optional]</term>
						<listitem>
							<para>
								The <sgmltag class="attribute">priority</sgmltag> attribute is of type 
								<sgmltag class="attvalue">xs:nonNegativeInteger</sgmltag>.  See 
								<xref linkend="s.priority.attribute" />.
							</para>
						</listitem>
					</varlistentry>
				</variablelist>
			</para>

			<para>The following schema fragment defines the <sgmltag class="starttag">URI</sgmltag> element:
				 <programlisting>URI = element URI {
    attribute priority { xs:nonNegativeInteger } ?,
    other.attribute *,
    xs:anyURI
}</programlisting>
			</para>
		</section>

		<section id="s.element.uriTemplate">
			<title>Element <sgmltag class="starttag">URITemplate</sgmltag></title>
			<para>
				<sgmltag class="starttag">URITemplate</sgmltag> is of type <sgmltag class="attvalue">xs:string</sgmltag>. 

				The template syntax provides a simple format for URI transformation.  A template is a string containing 
				brace-enclosed ("{}") variable names marking the parts of the string that are to be substituted by the 
				corresponding variable values.  The dictionary of allowed variable names is defined by one or more 
				<sgmltag class="starttag">Rel</sgmltag> values of the enclosing <sgmltag class="starttag">Link</sgmltag>. 
				A template is transformed into a URI by substituting the variables (along with their enclosing braces) 
				with their calculated value.  If a variable name is prefixed by "%", any character in the variable 
				value other than unreserved <glossterm>must</glossterm> be percent-encoded per <xref linkend="rfc3986" />.
			</para>

			<para>
				This specification does not define when or how template variables are interposed into link templates.  Link 
				relationship values that wish to allow templating <glossterm>should</glossterm> specify such details.
			</para>
				
			<para>
				<sgmltag class="starttag">URITemplate</sgmltag> has the following attributes:

				<variablelist spacing="compact">
					<varlistentry>
						<term><sgmltag class="attribute">priority</sgmltag> [Optional]</term>
						<listitem>
							<para>
								The <sgmltag class="attribute">priority</sgmltag> attribute is of type 
								<sgmltag class="attvalue">xs:nonNegativeInteger</sgmltag>.  See 
								<xref linkend="s.priority.attribute" />.
							</para>
						</listitem>
					</varlistentry>
				</variablelist>
			</para>

			<para>The following schema fragment defines the <sgmltag class="starttag">URITemplate</sgmltag> element:
				 <programlisting>URITemplate = element URITemplate {
    attribute priority { xs:nonNegativeInteger } ?,
    other.attribute *,
    xs:string
}</programlisting>
			</para>

		</section>

	</section>

	<section id="s.section.extensibility">
		<title>XRD Extensibility</title>

		<para>
			The XRD schema defines only the basic elements necessary to support the most common use cases, with the 
			explicit intention that applications will extend XRD to include any other metadata about the resources 
			they describe.  XRD documents can be extended by providing custom, meaningful values for certain 
			URI-based elements, as well as by extending the XML elements directly.
		</para>

		<section id="s.extensibility.identifiers">
			<title>Identifier Extension</title>

			<para>
				XRD uses URI-based identifiers for <link linkend="s.element.type">describing resources</link> as
				well as for <link linkend="s.element.rel">describing the relationships</link> between resources. It 
				is expected that applications will use appropriate established URI identifiers for these purposes, or 
				define new identifiers as necessary.  It is <glossterm>recommended</glossterm> that any new
				identifiers be defined in a formal specification of use. In no case should the meaning of a given URI 
				used as such an identifier significantly change, or be used to mean two different things. 
			</para>
		</section>

		<section id="s.extensibility.schema">
			<title>Schema Extension</title>

			<para>
				The XRD schema allows for the inclusion of attributes from arbitrary namespaces (except for the XRD 
				namespace) in all XRD elements.  Additionally, the <sgmltag class="starttag">XRD</sgmltag> and 
				<sgmltag class="starttag">Link</sgmltag> elements allow for the inclusion of child elements from arbitrary 
				namepsaces (except for the XRD namespace).
			</para>

			<para>
				XML extensions <glossterm>must not</glossterm> require new interpretation of elements defined in this 
				document. If an extension element is present, a processor <glossterm>must</glossterm> be able to 
				ignore it and still correctly process the XRD document. 
			</para>

		</section>

	</section>
</section>

<section id="s.processing.xrd">
	<title>Processing XRD Documents</title>

	<para>
		XRD documents identify other resources which are related to the resource the XRD is describing.  Once the 
		document has been obtained, the consuming application typically performs resource selection to extract the 
		descriptions of resources relevant to it.  The selection process involves iterating through the list of 
		related resource descriptions, filtering them based on various metadata, and selecting them based on their 
		relative priorities. 
	</para>

	<section id="s.priority.attribute">
		<title>Priority Attribute</title>

		<para>
			XRD allows the <sgmltag class="starttag">Link</sgmltag>, <sgmltag class="starttag">URI</sgmltag>, and 
			<sgmltag class="starttag">URITemplate</sgmltag> elements to appear multiple times within the same parent element 
			to provide redundancy, flexibility, or for other purposes.  When these elements appear more than once within the 
			same parent, XRD publishers <glossterm>should</glossterm> use the <sgmltag class="attribute">priority</sgmltag> 
			attribute to prioritize selection of these element instances. 
		</para>

		<para>
			The <sgmltag class="attribute">priority</sgmltag> attribute type is 
			<sgmltag class="attvalue">xs:nonNegativeInteger</sgmltag> - its value <glossterm>must</glossterm> be 
			a non-negative integer value.  The attribute works in a similar manner to DNS records priority, where 
			the lowest value has the highest priority.  This means zero has the highest priority and infinity - 
			represented by the absence of the <sgmltag class="attribute">priority</sgmltag> attribute - carries 
			the lowest priority.  Instead of omitting the attribute, however, it is <glossterm>recommended</glossterm> 
			to follow the standard practice in DNS and set the priority value to <sgmltag class="attvalue">10</sgmltag>. 
			When a publisher wishes to indicate a very low priority, it is <glossterm>recommended</glossterm> to 
			use a large finite value (100 or higher) rather than omitting the attribute.
		</para>

		<para>
			Consuming applications <glossterm>should</glossterm> select the element with the highest priority - 
			the lowest numeric value of the priority attribute. In the following example, the URIs decreasing order 
			of priority is <sgmltag class="attvalue">0</sgmltag>, <sgmltag class="attvalue">10</sgmltag>, 
			<sgmltag class="attvalue">11</sgmltag>, <sgmltag class="attvalue">25</sgmltag>, and last the element 
			with the omitted <sgmltag class="attribute">priority</sgmltag> attribute.
		</para>

		<programlisting><![CDATA[<Link>
    <URI priority="10">http://example.com/second</URI>
    <URI priority="25">http://example.com/fourth</URI>
    <URI priority="11">http://example.com/third</URI>
    <URI priority="0">http://example.com/highest</URI>
    <URI>http://example.com/lowest</URI>
</Link>]]></programlisting>

		<para>
			If two or more instances of the same element type have identical <sgmltag class="attribute">priority</sgmltag> 
			attribute values (including infinity), the consuming application <glossterm>should</glossterm> select one 
			of the instances at random, and not simply choose the first instance that appears in XML document order.
		</para>

		<para>
			The element selected according to these rules is referred to as the highest priority element. If this 
			element is subsequently disqualified from the set of qualified elements, the consuming application 
			<glossterm>should</glossterm> attempt to select the next highest priority element. This process 
			<glossterm>should</glossterm> be continued for all other instances of the qualified elements until 
			success is achieved or all instances are exhausted.
		</para>

		<section id="s.uri.priority">
			<title>Priority of &lt;URI&gt; and &lt;URITemplate&gt; elements</title>
			<para>
				The URI for a related resource can be expressed using two different elements, 
				<sgmltag class="starttag">URI</sgmltag> and <sgmltag class="starttag">URITemplate</sgmltag>, which differ 
				only in the fact that templates require addtional processing in order to obtain the final URI.  Therefore, 
				elements of both types <glossterm>should</glossterm> be combined and sorted together in order to obtain the 
				URI of highest priority.  In the following example, the highest priority URI would be the resultant URI from 
				processing the template <literal>{uri};service</literal>.
			</para>
				
			<programlisting><![CDATA[<Link>
    <URI priority="20">http://example.com/</URI>
    <URITemplate priority="10">{uri};service</URI>
</Link>]]></programlisting>

		</section>
	</section>

	<section id="s.linked.xrds">
		<title>Linked XRD Documents</title>

		<para>
			The XRD document for a resource may assert that a different XRD document may be used as an equally valid 
			descriptor for the same described resource.  This allows for distributed management of descriptor documents, 
			both within and across authority boundaries.  A linked XRD is identified by a 
			<sgmltag class="starttag">Link</sgmltag> containing a <sgmltag class="starttag">Rel</sgmltag> value of 
			<literal>http://docs.oasis-open.org/xri/xrd/rel/see-also</literal> and a specified 
			<sgmltag>Subject</sgmltag> value, as demonstrated in the following example.
		</para>

			<programlisting><![CDATA[<Link>
    <Subject>http://joe.example.com/</Subject>
    <Rel>http://docs.oasis-open.org/xri/xrd/rel/see-also</Rel>
    <URI>http://example.net/xrd.xml</URI>
</Link>]]></programlisting>

	</section>

	<section id="s.resource.selection">
		<title>Related Resource Selection</title>

		<para>
			Based on the consuming application's needs, the application defines a selection criteria based on the 
			presence (or lack of) certain resource relationship values and media-types.  The selection criteria 
			can be any combination of metadata describing the linked resources such as 
			<sgmltag class="starttag">Rel</sgmltag>, <sgmltag class="starttag">MediaType</sgmltag>, 
			<sgmltag class="starttag">URI</sgmltag>, or non-XRD extension elements or attributes.  For example, an 
			application can look for all related resources with an image media-type, the URI of a related resource 
			with a SAML authentication relationship, or the properties of a specific related resource given its URI.
		</para>

		<para>
			If the selection criteria place higher preference on the presence of certain relationships or media-types 
			over others, it is handled by performing multiple selections. Each selection is assigned preference order 
			based on the consuming application's needs and the selection results are compared to determine the most 
			desired set. For example, if an application is looking for all image resources, giving higher preference 
			to the JPEG formats over PNG, it will perform two selection processes, one for each media-type, and 
			assign the resources in the JPEG set a higher preference value.
		</para>

		<para>
			The consuming application performs the following steps in order to select the desired related resource descriptions:

			<itemizedlist spacing="compact">
				<listitem>
					<para>
						Each <sgmltag class="starttag">Link</sgmltag> element is compared against the selection 
						criteria by comparing the values of the <sgmltag class="starttag">Link</sgmltag> child 
						elements and attributes to those defined by the selection criteria.
					</para>
				</listitem>

				<listitem>
					<para>
						If more than one <sgmltag class="starttag">Link</sgmltag> element is matched, the consuming 
						application <glossterm>must</glossterm> use the <sgmltag class="attribute">priority</sgmltag> 
						attribute values to find the highest priority element as defined in 
						<xref linkend="s.priority.attribute" />.
					</para>
				</listitem>

				<listitem>
					<para>
						Within a matching <sgmltag class="starttag">Link</sgmltag> element, if more than one 
						<sgmltag class="starttag">URI</sgmltag> or <sgmltag class="starttag">URITemplate</sgmltag> 
						elements are present, the consuming application <glossterm>must</glossterm> use the 
						<sgmltag class="attribute">priority</sgmltag> attribute values to find the highest priority 
						element as defined in <xref linkend="s.uri.priority" />.
					</para>
				</listitem>

				<listitem>
					<para>
						If no <sgmltag class="starttag">Link</sgmltag> elements meet the selection criteria, the 
						consuming application <glossterm>should</glossterm> look for linked XRD documents, using the 
						search criteria defined in <xref linkend="s.linked.xrds" />.  If more than one linked XRD is 
						found, they <glossterm>must</glossterm> be processed in priority order, as defined in 
						<xref linkend="s.priority.attribute" />.  If the linked resource is a valid XRD document, the 
						consuming application <glossterm>should</glossterm> repeat this resource selection flow on the 
						linked XRD.  If the linked resource is not a valid XRD document, or a matching 
						<sgmltag class="starttag">Link</sgmltag> element cannot be found in the linked XRD, the 
						consuming application <glossterm>should</glossterm> continue with the next linked XRD.  A 
						consuming application <glossterm>may</glossterm> choose to limit the depth to which it will 
						follow linked XRD documents for performance or other reasons.
					</para>
				</listitem>
			</itemizedlist>
		</para>

	</section>

	<section id="s.subject.matching">
		<title>Subject Matching</title>
		<para>{TODO: Different rules for subject matching}</para>
	</section>

</section>

<section id="s.section.signature">
	<title>XRD Signature</title>

	<para>
		The <xref linkend="xml-sig" /> specification calls out a general XML syntax for signing data with flexibility 
		and many choices. This section details constraints on these facilities so that XRD consuming applications do not 
		have to deal with the full generality of XML Signature processing.
	</para>

	<section id="s.signature.formats">
		<title>Signing Formats and Algorithms</title>

		<para>
			XML Signature has three ways of relating a signature to a document: enveloping, enveloped, and detached. 
			XRD documents <glossterm>must</glossterm> use enveloped signatures when signing. XRD consuming applications 
			<glossterm>should</glossterm> support the use of RSA signing and verification for public key operations in 
			accordance with the algorithm identified by <literal>http://www.w3.org/2000/09/xmldsig#rsa-sha256</literal>. 
		</para>

	</section>

	<section id="s.signature.references">
		<title>References</title>

		<para>
			XRD documents <glossterm>must</glossterm> supply a value for the <sgmltag class="attribute">xml:id</sgmltag> 
			attribute on the root element of the XRD being signed. The XRD's root element may or may not be the root 
			element of the actual XML document containing the signed XRD  (e.g., it might be contained within an 
			<sgmltag class="starttag">XRDS</sgmltag> sequence element). 
		</para>

		<para>
			Signatures <glossterm>must</glossterm> contain a single <sgmltag class="starttag">ds:Reference</sgmltag> 
			containing a same-document reference to the <sgmltag class="attribute">xml:id</sgmltag> attribute value of 
			the root element of the XRD being signed. For example, if the <sgmltag class="attribute">xml:id</sgmltag> 
			attribute value is <sgmltag class="attvalue">foo</sgmltag>, then the <sgmltag class="attribute">URI</sgmltag> 
			attribute in the <sgmltag class="starttag">ds:Reference</sgmltag> element <glossterm>must</glossterm> be 
			<sgmltag class="attvalue">#foo</sgmltag>. 
		</para>
	</section>

	<section id="s.signature.canonicalization">
		<title>Canonicalization</title>

		<para>
			XRD implementations <glossterm>must</glossterm> use <xref linkend="excl-c14n" />, with or without comments, 
			both in the <sgmltag class="starttag">ds:CanonicalizationMethod</sgmltag> element of 
			<sgmltag class="starttag">ds:SignedInfo</sgmltag>, and as a <sgmltag class="starttag">ds:Transform</sgmltag> 
			algorithm. Use of Exclusive Canonicalization ensures that signatures created over XRD documents embedded in 
			an XML context can be verified independent of that context. 
		</para>
	</section>

	<section id="s.signature.transforms">
		<title>Transforms</title>

		<para>
			Signatures in XRD documents <glossterm>must not</glossterm> contain transforms other than the enveloped 
			signature transform (with the identifier 
			<literal>http://www.w3.org/2000/09/xmldsig#enveloped-signature</literal>) or the exclusive canonicalization 
			transforms (with the identifier <literal>http://www.w3.org/2001/10/xml-exc-c14n#</literal> or 
			<literal>http://www.w3.org/2001/10/xml-exc-c14n#WithComments</literal>). 
		</para>
	</section>

	<section id="s.signature.keyinfo">
		<title>KeyInfo</title>

		<para>
			XML Signature defines usage of the <sgmltag class="starttag">ds:KeyInfo</sgmltag> element. XRD does not 
			require the use of <sgmltag class="starttag">ds:KeyInfo</sgmltag>, nor does it impose any restrictions on 
			its use. Therefore, <sgmltag class="starttag">ds:KeyInfo</sgmltag> <glossterm>may</glossterm> be absent. 
		</para>
	</section>

	<section id="s.signature.example">
		<title>Example</title>

		<para>
			Following is an example of a signed XRD document.  Line breaks have been added for readability; the 
			signatures are not valid and cannot be successfully verified.
		</para>

		<programlisting><![CDATA[<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0"; xml:id="foo" 
    expires="1970-01-01T00:00:00Z">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> 
        <ds:SignedInfo> 
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
            <ds:Reference URI="#foo">
                <ds:Transforms> 
                    <ds:Transform 
                        Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> 
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#";> 
                        <InclusiveNamespaces PrefixList="#default xrd ds xs xsi" 
                            xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
                    </ds:Transform> 
                </ds:Transforms> 
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
                <ds:DigestValue>TCDVSuG6grhyHbzhQFWFzGrxIPE=</ds:DigestValue>
            </ds:Reference> 
        </ds:SignedInfo>
        <ds:SignatureValue> 
            x/GyPbzmFEe85pGD3c1aXG4Vspb9V9jGCjwcRCKrtwPS6vdVNCcY5rHaFPYWkf+5 
            EIYcPzx+pX1h43SmwviCqXRjRtMANWbHLhWAptaK1ywS7gFgsD01qjyen3CP+m3D 
            w6vKhaqledl0BYyrIzb4KkHO4ahNyBVXbJwqv5pUaE4= 
        </ds:SignatureValue> 
        <ds:KeyInfo> 
            <ds:X509Data> 
                <ds:X509Certificate> 
                    MIICyjCCAjOgAwIBAgICAnUwDQYJKoZIhvcNAQEEBQAwgakxCzAJBgNVBAYTAlVT 
                    MRIwEAYDVQQIEwlXaXNjb25zaW4xEDAOBgNVBAcTB01hZGlzb24xIDAeBgNVBAoT 
                    F1VuaXZlcnNpdHkgb2YgV2lzY29uc2luMSswKQYDVQQLEyJEaXZpc2lvbiBvZiBJ 
                    bmZvcm1hdGlvbiBUZWNobm9sb2d5MSUwIwYDVQQDExxIRVBLSSBTZXJ2ZXIgQ0Eg 
                    LS0gMjAwMjA3MDFBMB4XDTAyMDcyNjA3Mjc1MVoXDTA2MDkwNDA3Mjc1MVowgYsx
                    CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhNaWNoaWdhbjESMBAGA1UEBxMJQW5uIEFy
                    Ym9yMQ4wDAYDVQQKEwVVQ0FJRDEcMBoGA1UEAxMTc2hpYjEuaW50ZXJuZXQyLmVk 
                    dTEnMCUGCSqGSIb3DQEJARYYcm9vdEBzaGliMS5pbnRlcm5ldDIuZWR1MIGfMA0G 
                    CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZSAb2sxvhAXnXVIVTx8vuRay+x50z7GJj 
                    IHRYQgIv6IqaGG04eTcyVMhoekE0b45QgvBIaOAPSZBl13R6+KYiE7x4XAWIrCP+ 
                    c2MZVeXeTgV3Yz+USLg2Y1on+Jh4HxwkPFmZBctyXiUr6DxF8rvoP9W7O27rhRjE 
                    pmqOIfGTWQIDAQABox0wGzAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIFoDANBgkq 
                    hkiG9w0BAQQFAAOBgQBfDqEW+OI3jqBQHIBzhujN/PizdN7s/z4D5d3pptWDJf2n 
                    qgi7lFV6MDkhmTvTqBtjmNk3No7v/dnP6Hr7wHxvCCRwubnmIfZ6QZAv2FU78pLX 
                    8I3bsbmRAUg4UP9hH6ABVq4KQKMknxu1xQxLhpR1ylGPdiowMNTrEG8cCx3w/w== 
                </ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <Subject>http://example.com/gpburdell</Subject>
    <Link>
        <Rel>http://spec.example.net/auth/1.0</Rel>
        <URI>http://services.example.com/auth</URI>
    </Link>
</XRD>
]]></programlisting>
	</section>

</section>


<section id="s.section.trust">
	<title>XRD Trust</title>
	<para>
		Combining the digital signature capability and XRD processing, 
		XRD can be used to establish Trust within application in various ways. 
		The Trust is application specific and needs to be specified in profiles 
		for each applications.   {TODO: finish this}
	</para>

</section>

<section id="s.conformance">
	<title>Conformance</title>
	<para>
		An implementation is a <glossterm>conforming</glossterm> XRD consuming application if the implementation meets 
		the conditions in <xref linkend="s.conformance.consumer" />.  An implementation is a 
		<glossterm>conforming</glossterm> XRD publisher if the implementation meets the conditions in 
		<xref linkend="s.conformance.publisher" />.  An implementation may serve as both an XRD consuming application
		and publisher.
	</para>

	<section id="s.conformance.consumer">
		<title>XRD Consuming Application</title>
		<para>
			An implementation conforms to this specification as an XRD consuming application if it meets the following
			conditions:

			<orderedlist spacing="compact">
				<listitem>
					<para>
						It <glossterm>must</glossterm> implement parsing of XRD documents which conform to the XRD 
						schema as specified in <xref linkend="s.document.structure" />.
					</para>
				</listitem>
				<listitem>
					<para>
						It <glossterm>must</glossterm> conform to the processing rules as specified in 
						<xref linkend="s.processing.xrd" />.
					</para>
				</listitem>
			</orderedlist>
		</para>
	</section>

	<section id="s.conformance.publisher">
		<title>XRD Publisher</title>
		<para>
			An implementation conforms to this specification as an XRD publisher if it meets the following
			conditions:

			<orderedlist spacing="compact">
				<listitem>
					<para>
						Any published XRD documents <glossterm>must</glossterm> conform to the XRD schema as 
						specified in <xref linkend="s.document.structure" />.
					</para>
				</listitem>
			</orderedlist>
		</para>
	</section>
</section>

<appendix id="a.committee" role="non-normative">
	<title>Acknowledgments</title>

	<para>
		The editors would like to thank the following current and former members of the OASIS XRI TC 
		for their particular contributions to this and previous versions of this specification: 
	</para>

	<itemizedlist spacing="compact">
		<listitem><para>{TODO}</para></listitem>
	</itemizedlist>

	<para>
		The editors would also like to acknowledge the contributions of the other members of the OASIS 
		XRI Technical Committee, whose other voting members at the time of publication were: 
	</para>

	<itemizedlist spacing="compact">
		<listitem><para>{TODO}</para></listitem>
	</itemizedlist>

</appendix>

<appendix id="a.media-type">
	<title>Media Type Definition for <literal>application/xrd+xml</literal></title>

	<para>
		This section is prepared in anticipation of filing a media type registration meeting the requirements of 
		<xref linkend="rfc4288" />.
	</para>

	<variablelist>
		<varlistentry>
			<term>Type name:</term>
			<listitem>
				<para><code>application</code></para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Subtype name:</term>
			<listitem>
				<para><code>xrd+xml</code></para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Required parameters:</term>
			<listitem>
				<para>None</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Optional paramters:</term>
			<listitem>
				<para>None</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Encoding considerations:</term>
			<listitem>
				<para>
					Identical to those of <code>application/xml</code> as described by <xref linkend="rfc3023" />
				</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Security considerations:</term>
			<listitem>
				<para>
					As defined in this specification. In addition, as this media type uses the 
					"+xml" convention, it shares the same security considerations as described in 
					<xref linkend="rfc3023" />, Section 10. 
				</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Interoperability considerations:</term>
			<listitem>
				<para>There are no known interoperability issues.</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Published specification:</term>
			<listitem>
				<para>This specification</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Applications that use this media type:</term>
			<listitem>
				<para>Applications conforming to this specification use this media type.</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Person &amp; email address to contact for further information:</term>
			<listitem>
				<para>Drummond Reed, OASIS XRI Technical Committee Co-Chair, drummond.reed@cordance.net</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Intended usage:</term>
			<listitem>
				<para>COMMON</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Restrictions on usage:</term>
			<listitem>
				<para>None</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Author</term>
			<listitem>
				<para>OASIS XRI Technical Comittee</para>
			</listitem>
		</varlistentry>

		<varlistentry>
			<term>Change controller:</term>
			<listitem>
				<para>OASIS XRI Technical Comittee</para>
			</listitem>
		</varlistentry>

			
	</variablelist>

</appendix>

<bibliography id="bibl"><title>References</title>

	<bibliodiv>
		<bibliomixed id="rfc2046">
			<abbrev>RFC 2046</abbrev> N. Freed, N. Borenstein
			<citetitle><ulink url="http://tools.ietf.org/html/rfc2046";>Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types</ulink></citetitle>.  
			IETF (Internet Engineering Task Force). 1996.
		</bibliomixed>

		<bibliomixed id="rfc2119">
			<abbrev>RFC 2119</abbrev> S. Bradner.
			<citetitle><ulink url="http://tools.ietf.org/html/rfc2119";>Key words for use in RFCs to Indicate Requirement Levels</ulink></citetitle>.  
			IETF (Internet Engineering Task Force). 1997.
		</bibliomixed>

		<bibliomixed id="rfc2606">
			<abbrev>RFC 2606</abbrev> E. Eastlake, A. Panitz
			<citetitle><ulink url="http://tools.ietf.org/html/rfc2606";>Reserved Top Level DNS Names</ulink></citetitle>.
			IETF (Internet Engineering Task Force). 1999.
		</bibliomixed>

		<bibliomixed id="rfc2616">
			<abbrev>RFC 2616</abbrev> R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, T. Berners-Lee
			<citetitle><ulink url="http://tools.ietf.org/html/rfc2616";>Hypertext Transfer Protocol -- HTTP/1.1</ulink></citetitle>.
			IETF (Internet Engineering Task Force). 1999.
		</bibliomixed>

		<bibliomixed id="rfc3023">
			<abbrev>RFC 3023</abbrev> M. Murata, S. St.Laurent, D. Kohn
			<citetitle><ulink url="http://tools.ietf.org/html/rfc3023";>XML Media Types</ulink></citetitle>.
			IETF (Internet Engineering Task Force). 2001.
		</bibliomixed>

		<bibliomixed id="rfc3986">
			<abbrev>RFC 3986</abbrev> T. Berners-Lee, R. Fielding, L. Masinter 
			<citetitle><ulink url="http://tools.ietf.org/html/rfc3986";>Uniform Resource Identifiers (URI): Generic Syntax</ulink></citetitle>.
			IETF (Internet Engineering Task Force). 2005.
		</bibliomixed>

		<bibliomixed id="rfc4287">
			<abbrev>RFC 4287</abbrev> M. Nottingham
			<citetitle><ulink url="http://tools.ietf.org/html/rfc4287";>The Atom Syndication Format</ulink></citetitle>.
			IETF (Internet Engineering Task Force). 2005.
		</bibliomixed>

		<bibliomixed id="rfc4288">
			<abbrev>RFC 4288</abbrev> N. Freed, J. Klensin
			<citetitle><ulink url="http://tools.ietf.org/html/rfc4288";>Media Type Specifications and Registration Procedures</ulink></citetitle>.
			IETF (Internet Engineering Task Force). 2005.
		</bibliomixed>

		<bibliomixed id="relaxng-compact">
			<abbrev>RELAX NG Compact</abbrev> J. Clark
			<citetitle><ulink url="http://www.oasis-open.org/committees/relax-ng/compact.html";>RELAX NG Compact Syntax</ulink></citetitle>.
			OASIS Committee Specification. 2002
		</bibliomixed>

		<bibliomixed id="html-4">
			<abbrev>HTML 4.01</abbrev> D. Raggett
			<citetitle><ulink url="http://www.w3.org/TR/html401/";>HTML 4.01 Specification</ulink></citetitle>.
			W3 Recommendation. 1999
		</bibliomixed>

		<bibliomixed id="xhtml-1">
			<abbrev>XHTML 1.0</abbrev>
			<citetitle><ulink url="http://www.w3.org/TR/xhtml1/";>XHTML 1.0 The Extensible HyperText Markup Language (Second Edition)</ulink></citetitle>.
			W3 Recommendation. 2000
		</bibliomixed>

		<bibliomixed id="link-header">
			<abbrev>HTTP Link Header</abbrev> M. Nottingham
			<citetitle><ulink url="http://tools.ietf.org/html/draft-nottingham-http-link-header";>Link Relations and HTTP Header Linking</ulink></citetitle>.
			IETF (Internet Engineering Task Force) Draft. 2009.
		</bibliomixed>

		<bibliomixed id="site-meta">
			<abbrev>Site Meta</abbrev> M. Nottingham, E. Hammer-Lahav
			<citetitle><ulink url="http://tools.ietf.org/html/draft-nottingham-site-meta";>Host Metadata for the Web</ulink></citetitle>.
			IETF (Internet Engineering Task Force) Draft. 2009.
		</bibliomixed>

		<bibliomixed id="xri-resolution-2">
			<abbrev>XRI Resolution 2.0</abbrev> G. Wachob
			<citetitle><ulink url="http://docs.oasis-open.org/xri/2.0/specs/xri-resolution-V2.0.html";>Extensible Resource Identifier (XRI) Resolution V2.0</ulink></citetitle>.
			February 2008.
		</bibliomixed>

		<bibliomixed id="lrdd">
			<abbrev>LRDD</abbrev> E. Hammer-Lahav
			<citetitle><ulink url="http://tools.ietf.org/html/draft-hammer-discovery";>Link-based Resource Descriptor Discovery</ulink></citetitle>.
			IETF (Internet Engineering Task Force) Draft. 2009.
		</bibliomixed>

		<bibliomixed id="xml-id">
			<abbrev>xml:id</abbrev> J. Marsh, et al
			<citetitle><ulink url="http://www.w3.org/TR/xml-id/";>xml:id</ulink></citetitle>.
			W3 Recommendation. 2005
		</bibliomixed>

		<bibliomixed id="xml-sig">
			<abbrev>XML Signature</abbrev> D. Eastlake, et al
			<citetitle><ulink url="http://www.w3.org/TR/xmldsig-core/";>XML Signature Syntax and Processing</ulink></citetitle>.
			W3 Recommendation. 2008
		</bibliomixed>

		<bibliomixed id="excl-c14n">
			<abbrev>Exclusive Canonicalization</abbrev> J. Boyer, et al
			<citetitle><ulink url="http://www.w3.org/TR/xml-exc-c14n/";>Exclusive XML Canonicalization</ulink></citetitle>.
			W3 Recommendation. 2002
		</bibliomixed>

	</bibliodiv>

</bibliography>

</article>