FW: Changelog A5

 
103 - Blair point about private key processing [see also my point on
private key encryption]
 
Added Blair's text and the following security consideration:

Implementations MUST ensure that in cases where a private key is
generated by the service, the information used to encrypt the private
key data is adequately protected. In particular if an authentication
pass phrase exchanged out of band is used to encrypt the private key the
implementation MUST ensure that the out of band communication mechanism
adequately protects the confidentiality of the pass phrase.

It is recommended that implementations make use of TLS or an in-band key
exchange mechanism to protect the private key in the case that the
authentication pass phrase is disclosed. 

 
New issue 125 - add in an element of abstract type to the relevant
operations (Register, Recover) that may be used as a derrivation point
for a key exchange such as XKASS?