Here is a starting point:
(1) Do we need to support all
three forms of signing? Detached, enveloping and enveloped
(2) Do we need to support all the varied forms of the
<KeyInfo> element?
(3) What is the relationship between a signed response and
the assertions contained within the response? Under what
circumstances should the "super-signature" apply to the embedded
assertions. Similar questions arise for requests.
I had initiated some discussion in the general vicinity of (3)
in
http://lists.oasis-open.org/archives/security-services/200106/msg00167.html
- prateek
>>
>>
>>On a previous concall, I suggested the first thing to do was
>>draw up a list
>>of what questions need to be answered to create a profile. I
>>don't believe
>>this is explicit in the spec. I also suggested that Stephen
>>Farrell might
>>provide useful input.
>>
>>Hal
>>
