Discussion question for today's meeting re: Pasword-based key derivation (Issue #282)

["Hal Lockhart" <hlockhar@bea.com>]

I hade expected to have the text complete for this prior to today. I will have it shortly. I do have one question for discussion today:

The Algorithm for deriving a key from a password clearly belongs in the Username Profile. However, where should the necessary schema extensions (salt and iteration) go, in the core or the Username Profile? It appears that the precident is to describe all wsse: and wsu: syntax in the core document and then to describe token-specific processing in the Profile. This would require changes to both. Should I do this or define everything in the Username Profile?

Hal