Thanks Sven.  Sounds like good updates :-)

I wonder on this as well.  This seems like a circular problem.  We need to
bootstrap the process somehow.  As we don't have a SCT token yet (and don't
want to use a UT), we can't encrypt/sign the request in the normal WSE way.
I guess we could use x509securitytoken or something, but the idea was to not
require certs to begin with.  We probably could use secure XML, but that is
effectively what I am doing manually and I found SecXML way too confusing.
Therefore this "manual" use of xml and encrypting elements and signatures is
needed to kick start the process.  If you think about it, the GetSCT()
method *is the TokenIssuer, so not sure what wrapping it again in some other
issuer would offer (it does need to be built into the framework however).
If you think about it, the RequestSecurityToken and
SecurityContextTokenService stuff is really just doing the same thing,
however they use a x509 cert and cert's public key instead of just a public
key of our choosing.  I have not yet drilled down into it see exactly what
they are doing or the wire format, but that would be cool to know.

The other thing I thought about was to use just an anonymous account to
return a SCT, then you could request a "real" authenticated SCT using std
WS-Security.  However, I don't think you gain anything but more
request/reply pairs (i.e traffic).  I also thought about doing some other
shared secret deal using Diffie-Hellman, etc.  However that gains you
nothing either as your just getting a shared key to get another shared key.
I could, however, use DH to generate the shared key in the request/reply
pair.  But I asked myself what that would offer.  You would have to break
public PKI to find the secret that way it is (unless someone sees
something), so not sure that would offer anything as would still need to
protect against MITM attack for DH.  The GetSCT() process allows
authentication and SCT token generation in one request/reply pair, so it
seems better then anything else I could think of.  If you have other ideas,
please let me know.

Cheers!

I receive an exception when calling GetSCT  in the line

       AESKey = RSA.Decrypt(TokenRequest.AESKey,
RSA.GetKeyPairAsXml("Adduxis.Components.Security.Samples.RSA"))

The Adduxis.Components.Security namespace in the assembly I have does not
have the Samples namespace and so throws an exception.



Thank you.