Comments below.
> -----Original Message-----
> From: [mailto:]
> Sent: Wednesday, April 23, 2003 3:54 PM
> To: ;
> Subject: RE: [wss] Interop Scenario Descriptions - New Format
>
>
> I think we need parentheses to clarify the time calculation in
> 4.4.3.4. Is it
> reject IF older than (current time - (nonce + max-skew))?
You are correct, the sign is wrong. I will fix it.
> I'm also not sure why wsu:Expires isn't used, as
>
> reject IF current time > (wsu:Expires + |max-skew|).
The reason is that is up to the reciver how big a cache of nonces to use.
> Perhaps this time testing is not necessary for the purposes of test 2
> which is focused on the encryption or test 3 focused on signing +
> encryption.
It is not used in Scenario #3 because the body is signed and encrypted, not
a password token.
In Scenario #2 if we are going to send an encrypted password, we should
create a model of how to do it right.
Do others disagree with me?
> Depending on interop goal and time constraints, should the
> expiration testing be included as a
> fourth test?
>
I assume people will write their code before they arrive, so I don't see the
advantage of this.
Hal
