> <quote> > The Username Token profile does not currently define a key > derivation algorithm. The OASIS WSS TC is expected to address > this issue in a subsequent specification. </quote>
The latest (March 2005 and onward) WSS 1.1 draft of the UsernameToken profile defines key derivation in section 4. Hans
