Password Based Key Derivation (Revisited)

[Michael McIntosh <mikemci@us.ibm.com>]

WSS TC,

The WS-I Basic Security Profile WG has
been considering whether to provide guidance on the use of password based
key derivation. While some believe that derivation of keys from passwords
is unsafe at any speed, we acknowledge that some will continue to do it
anyway. It is the prevailing opinion of the WG that the WSS TC is the most
appropriate forum to address this issue. We (WS-I BSP WG) would like to
understand whether this TC intends to take ownership of this issue before
deciding how to continue.

Thanks,
Mike