RE: [wss] Interop Scenario Descriptions - New Format

["Hal Lockhart" <hlockhar@bea.com>]

Comments below.

> -----Original Message-----
> From: Frederick.Hirsch@nokia.com [mailto:Frederick.Hirsch@nokia.com]
> Sent: Wednesday, April 23, 2003 3:54 PM
> To: hlockhar@bea.com; wss@lists.oasis-open.org
> Subject: RE: [wss] Interop Scenario Descriptions - New Format
>
>
> I think we need parentheses to clarify the time calculation in
> 4.4.3.4. Is it
> reject IF older than (current time - (nonce + max-skew))?

You are correct, the sign is wrong. I will fix it.


> I'm also not sure why wsu:Expires isn't used, as
>
> reject IF current time > (wsu:Expires + |max-skew|).

The reason is that is up to the reciver how big a cache of nonces to use.


> Perhaps this time testing is not necessary for the purposes of test 2
> which is focused on the encryption or test 3 focused on signing +
> encryption.

It is not used in Scenario #3 because the body is signed and encrypted, not
a password token.

In Scenario #2 if we are going to send an encrypted password, we should
create a model of how to do it right.

Do others disagree with me?


> Depending on interop goal and time constraints, should the
> expiration testing be included as a
> fourth test?
>

I assume people will write their code before they arrive, so I don't see the
advantage of this.

Hal