[KEYPROV] Make DSKPP server authentication extensible

["Pei, Mingliang" <mpei at verisign.com>]

Hi Andrea and Salah,

Currently, the DSKPP draft rigidly limits the server authentication data
in KeyProvServerFinished to a MAC value over some data content. However,
there are use cases where other form of authentication data may be
available from a service provider for its server, for example, external
authentication data from a delegated third party authentication server.
Similar to the extensibility that we add to the client authentication
data format, I suggest that we also make the server authentication XML
schema extensible such that a service provider implementation may
support their additional authentication data.

The schema change will be minor. We already have AuthenticationDataType
extensible. We only need to change the authentication data in
KeyProvServerFinished from type AuthenticationMacType to more general
AuthenticationDataType.

Schema change:

Current:

<xs:complexType name="KeyProvServerFinishedPDU" mixed="false">
    ...
    <xs:element name="Mac" type="dskpp:MacType"/>
    <xs:element name="AuthenticationData"
type="dskpp:AuthenticationMacType" minOccurs="0"/>
    ...
</xs:complexType>

To

<xs:complexType name="KeyProvServerFinishedPDU" mixed="false">
    ...
    <xs:element name="Mac" type="dskpp:MacType"/>
    <xs:element name="AuthenticationData"
type="dskpp:AuthenticationDataType" minOccurs="0"/>
    ...
</xs:complexType>

where

<xs:complexType name="AuthenticationDataType">
    <xs:sequence>
        <xs:element name="ClientID" type="dskpp:IdentifierType" />
        <xs:choice>
            <xs:element name="AuthenticationCodeMac"
type="dskpp:AuthenticationMacType"
            <xs:any namespace="##other" processContents="strict" />
        </xs:choice>
    </xs:sequence>
</xs:complexType>
 
Thoughts?

- Ming