SOAP MustUnderstand issue

[<Frederick.Hirsch@nokia.com>]

It appears that the decision of whether mustUnderstand is true or false on a wsse:Security header block is up to the application - the SOAP Message Security specification indicates that mustUnderstand usage is optional. Is this an interoperability concern?

Does this mean that to obtain the result  of only what is used is implemented, e.g. DSAwithSHA1 vs RSAwithSHA1) means that the application should set this mustUnderstand wsse:Security header block attribute to false?

It seems that the relationship of interoperability and adequate/appropriate security processing is of concern here. If mustUnderstand is false, does that mean security is lost? I'd say no, since it is the relying party's obligation regardless to make sure policy is met - i.e. it shouldn't be driven by mustUnderstand.

Is our discussion to determine what it means if an application sets mustUnderstand to true?
Since an application can set it to false, is it harmful to take the stricter meaning that all is understood (deferring the discussion of whether that means implemented)?  Is that the consensus?

regards, Frederick

Frederick Hirsch
Nokia Mobile Phones