# zxid/sg/liberty-authentication-context-v2.0.sg
# Slightly edited, 5.9.2006, Sampo Kellomaki (sampo@iki.fi)
# $Id: liberty-authentication-context-v2.0.sg,v 1.3 2009-09-05 02:23:41 sampo Exp $
#
# N.B. This file is nearly identical to urn:liberty:ac:2003-08,
# liberty-authentication-context-1.2-errata-v1.0.xsd. Thus we adopt the convention
# of using this collection of authentication contexts.

target(ac, urn:liberty:ac:2004-12)
#include(liberty-utility-v2.0.xsd)   necessary definitions have been inline expanded

Extension        -> %ac:extensionType
%extensionType:
  any+  ns(##other)  processContents(lax)
  ;

AuthenticationContextStatement	 -> %ac:AuthenticationContextStatementType
Identification	 -> %ac:IdentificationType

PhysicalVerification:
  @credentialLevel?:	 enum( primary secondary ) ;
  ;
WrittenConsent:
  ac:Extension*
  ;

TechnicalProtection	 -> %ac:TechnicalProtectionType
SecretKeyProtection	 -> %ac:SecretKeyProtectionType
PrivateKeyProtection	 -> %ac:PrivateKeyProtectionType
KeyActivation	 -> %ac:KeyActivationType
KeySharing	 -> %ac:KeySharingType
KeyStorage	 -> %ac:KeyStorageType
Password	 -> %ac:PasswordType
ActivationPin	 -> %ac:ActivationPinType
Token            -> %ac:TokenType
TimeSyncToken	 -> %ac:TimeSyncTokenType

Smartcard:
  ac:Extension*
  ;

Length           -> %ac:LengthType
ActivationLimit  -> %ac:ActivationLimitType

Generation:
  @mechanism:	 enum( principalchosen automatic ) ;
  ;

AuthenticationMethod	 -> %ac:AuthenticationMethodType
PrincipalAuthenticationMechanism	 -> %ac:PrincipalAuthenticationMechanismType
Authenticator	 -> %ac:AuthenticatorType

PreviousSession:
  ac:Extension*
  ;
ResumeSession:
  ac:Extension*
  ;
ZeroKnowledge:
  ac:Extension*
  ;
SharedSecretChallengeResponse:
  ac:Extension*
  ;
DigSig:
  ac:Extension*
  ;
IPAddress:
  ac:Extension*
  ;
AsymmetricDecryption:
  ac:Extension*
  ;
AsymmetricKeyAgreement:
  ac:Extension*
  ;
SharedSecretDynamicPlaintext:
  ac:Extension*
  ;
AuthenticatorTransportProtocol	 -> %ac:AuthenticatorTransportProtocolType
HTTP:
  ac:Extension*
  ;
IPSec:
  ac:Extension*
  ;
WTLS:
  ac:Extension*
  ;
MobileNetworkNoEncryption:
  ac:Extension*
  ;
MobileNetworkRadioEncryption:
  ac:Extension*
  ;
MobileNetworkEndToEndEncryption:
  ac:Extension*
  ;
SSL:
  ac:Extension*
  ;
OperationalProtection	 -> %ac:OperationalProtectionType
SecurityAudit	 -> %ac:SecurityAuditType
SwitchAudit:
  ac:Extension*
  ;
DeactivationCallCenter:
  ac:Extension*
  ;
GoverningAgreements	 -> %ac:GoverningAgreementsType
GoverningAgreementRef	 -> %ac:GoverningAgreementRefType
AuthenticatingAuthority	 -> %ac:AuthenticatingAuthorityType
%IdentificationType:
  ac:PhysicalVerification?
  ac:WrittenConsent?
  ac:Extension*
  @nym?:	 enum( anonymity verinymity pseudonymity ) ;
  ;
%GoverningAgreementsType:
  ac:GoverningAgreementRef+
  ;
%GoverningAgreementRefType:
  @governingAgreementRef	 -> %xs:anyURI
  ;
%AuthenticatingAuthorityType:
  ac:GoverningAgreements
  @ID	 -> %xs:anyURI
  ;
%AuthenticatorTransportProtocolType:
  ac:HTTP?
  ac:SSL?
  ac:MobileNetworkNoEncryption?
  ac:MobileNetworkRadioEncryption?
  ac:MobileNetworkEndToEndEncryption?
  ac:WTLS?
  ac:IPSec?
  ac:Extension+
  ;
%PrincipalAuthenticationMechanismType:
  ac:Password?
  ac:Token?
  ac:Smartcard?
  ac:ActivationPin?
  ac:Extension+
  ;
%AuthenticationMethodType:
  ac:PrincipalAuthenticationMechanism?
  ac:Authenticator?
  ac:AuthenticatorTransportProtocol?
  ac:Extension*
  ;
%AuthenticationContextStatementType:
  ac:Identification?
  ac:TechnicalProtection?
  ac:OperationalProtection?
  ac:AuthenticationMethod?
  ac:GoverningAgreements?
  ac:AuthenticatingAuthority*
  ac:Extension*
  @ID?	 -> %xs:ID
  ;
%TechnicalProtectionType:
  ac:PrivateKeyProtection?
  ac:SecretKeyProtection?
  ac:Extension*
  ;
%OperationalProtectionType:
  ac:SecurityAudit?
  ac:DeactivationCallCenter?
  ac:Extension*
  ;
%AuthenticatorType:
  ac:PreviousSession?
  ac:ResumeSession?
  ac:DigSig?
  ac:Password?
  ac:ZeroKnowledge?
  ac:SharedSecretChallengeResponse?
  ac:SharedSecretDynamicPlaintext?
  ac:IPAddress?
  ac:AsymmetricDecryption?
  ac:AsymmetricKeyAgreement?
  ac:Extension+
  ;
%KeyActivationType:
  ac:ActivationPin?
  ac:Extension+
  ;
%KeySharingType:
  @sharing	 -> %xs:boolean
  ;
%PrivateKeyProtectionType:
  ac:KeyActivation?
  ac:KeyStorage?
  ac:KeySharing?
  ac:Extension*
  ;
%PasswordType:
  ac:Length?
  ac:Alphabet?
  ac:Generation?
  ac:Extension*
  ;
%ActivationPinType:
  ac:Length?
  ac:Alphabet?
  ac:Generation?
  ac:ActivationLimit?
  ac:Extension*
  ;

Alphabet	 -> %ac:AlphabetType
%AlphabetType:
  @requiredChars  -> %xs:string
  @excludedChars? -> %xs:string
  @case?          -> %xs:string
  ;

%TokenType:
  ac:TimeSyncToken
  ac:Extension*

  ;
%TimeSyncTokenType:
  @DeviceType:	 enum( hardware software ) ;
  @SeedLength	 -> %xs:integer
  @DeviceInHand:	 enum( true false ) ;
  ;

%ActivationLimitType:
  ac:ActivationLimitDuration?
  ac:ActivationLimitUsages?
  ac:ActivationLimitSession?
  ;
ActivationLimitDuration	 -> %ac:ActivationLimitDurationType
ActivationLimitUsages	 -> %ac:ActivationLimitUsagesType
ActivationLimitSession	 -> %ac:ActivationLimitSessionType
%ActivationLimitDurationType:
  @duration	 -> %xs:duration
  ;
%ActivationLimitUsagesType:
  @number	 -> %xs:integer
  ;

%LengthType:
  @min	 -> %xs:integer
  @max?	 -> %xs:integer
  ;
%KeyStorageType:
  @medium:	 enum( memory smartcard token MobileDevice MobileAuthCard ) ;
  ;
%SecretKeyProtectionType:
  ac:KeyActivation?
  ac:KeyStorage?
  ac:Extension+
  ;
%SecurityAuditType:
  ac:SwitchAudit?
  ac:Extension*
  ;

# EOF
