Hi Pablo,

thanks a lot for your quick answer.
I have tryed this, but it seems it does not work. MSDN says that
SecurityContextTokenService within WSE 2.0 uses Entropy of 128 bits in
length. I find the information that I can use proof token instead of
entropy to get an AES256 key. However, I can't find any example of how
to use the proof token to get AES256 key and how to configure
SecurityContextTokenService to work with proof tokens.

My web.config file looks as follows:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <configSections>
   <section name="microsoft.web.services2"
type="Microsoft.Web.Services2.Configuration.WebServicesConfiguration,
Microsoft.Web.Services2, Version=2.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
 </configSections>
 <microsoft.web.services2>
   <tokenIssuer>
     <autoIssueSecurityContextToken enabled="true" />
     <serverToken>
       <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
         <wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
           <wsse:KeyIdentifier
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X
509SubjectKeyIdentifier">3yCJD4BTZ2nPV7hgKB5pEz+fDM0=</wsse:KeyIdentifier>
         </wsse:SecurityTokenReference>
       </KeyInfo>
     </serverToken>
     <ttlInSeconds>315360000</ttlInSeconds>
   </tokenIssuer>
   <security>
     <x509 storeLocation="CurrentUser"
allowRevocationUrlRetrieval="false" verifyTrust="false" />
     <binarySecurityTokenManager
valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"

       <sessionKeyAlgorithm name="AES256" />
     </binarySecurityTokenManager>
   </security>
   <diagnostics>
     <trace enabled="true" input="InputTrace.webinfo"
output="OutputTrace.webinfo" />
   </diagnostics>
 </microsoft.web.services2>
 <system.web>
   <identity impersonate="true" userName="testuser" password="testpwd"
/>
   <webServices>
     <soapExtensionTypes>
       <add type="Microsoft.Web.Services2.WebServicesExtension,
Microsoft.Web.Services2, Version=2.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" priority="1" group="0" />
     </soapExtensionTypes>
   </webServices>
 </system.web>
</configuration>