MultipleCredentials [was: Re: I-D ACTION:draft-ietf-sacred-protocol-bss-01.txt]

Stephen,

Here are some comments on the modified support for multiple credentials in
draft-ietf-sacred-protocol-bss-01.txt,

1. In the schema, <CredentialSelector> is optional in sacred:CredentialType
but since all credentials MUST have a selector (section 2.5) it does not
seem as if it is valid for this element to not be present.

I therefore suggest that

         <element name="CredentialSelector" type="string" minOccurs="0"/>

be replaced with

         <element name="CredentialSelector" type="string" />


2. Since it is possible for a user to request all their credentials, a
DownloadResponse needs to be able to contain more than one credential.
(Section 2.5 states that "If the selector is omitted in a download request
it MUST be interpreted as a request for all the stored credentials.")

Section 3.9 should say something like

   This message contains the credentials.

And in the schema, the <DownloadResponse> element needs to be able to
contain more than one <Credential> element.  One possibility would be

     <element name="DownloadResponse">
       <complexType>
         <sequence>
           <element name="Status" type="string" minOccurs="0"/>
           <element name="Credential" type="sacred:CredentialType"
maxOccurs="unbounded"/>
         </sequence>
       </complexType>
     </element>

3. In the schema, the credential selector is called CredSel in a
<DownloadRequest> and CredentialSelector in the <sacred:CredentialType>

I think that since these are both referring to the same thing they should
have the same name.