RE: [wss] Comments on oasis-0005-wss-username-token-profile-1[1].0.pdf

Anthony, All –

Regarding an example with intermediate values for the Username Token profile, I think that at the very least the example XML fragment should contain correct values. That is, in the example starting on line 211 the text of the <wsse:Password> element should be the “right answer”, e.g. the encoded SHA-1 hash of the Nonce+Creation time.

Right now the value doesn’t correctly compute, but it ‘looks’ correct. I think we should either (a) truncate the <wsse:Password> element content, so at least we acknowledge the answer is wrong, or (b) put the right answer there. I’ve already done the computation on my last post, so if someone wants to check it over, we can just use my result. I used the same intermediate values as used in the example.

Also, what about the hardwiring of SHA-1 for the digest method? Should we provide an extensibility point here?

Regards,

Blake Dournaee

Senior Security Architect

Sarvega, Inc.

http://www.sarvega.com

-----Original Message-----
From: Anthony Nadalin [mailto:drsecure@us.ibm.com]
Sent: Thursday, December 11, 2003 7:08 PM
To: wss@lists.oasis-open.org
Subject: Re: [wss] Comments on oasis-0005-wss-username-token-profile-1[1].0.pdf

Blake, thanks

Will correct #1, #2, #3.

#4 seems a little odd to put in the document

#5 I can add the text if no one objects, I would add this around line 167 (in the element definition)

Anthony Nadalin | work 512.436.9568 | cell 512.289.4122

wss message