Re: Encryption and the processing model

> > I'm thinking that we need to require that the root element of each
> > header block be unencrypted.  In other words, the header "name"
> > and qualifiers (actor, mustUnderstand) MUST be visible.

I think that's too limiting. For example, a SET-like protocol where I
encrypt my bank header such that your bank can see it, but you can't.

I'd rather see us solve the problem in the documentation.

-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com