Password derivation

Hi Joseph,

in [1] section 4.2.10 there is stated:

"4.2.10: Password derivation: Unclear what it means, strike from 
requirements."

I guess I have an idea: Currently, I'm implementing an 
XML-Signature/Encryption-based KeyStore (for all the non-Java-Folks, a file 
which collects encrypted Keys, Certificates etc). The keys which are used 
in EncryptedData elements must be derived from user-supplied passwords. 
This means that a mechanism like the one defined in PKCS12 is used to 
derive a literal key from a used-supplied passphrase (or in Java lingo, to 
create a byte[] key from a char[] passphrase).

Question: How could this be incorporated into XML Encryption?

Example: I want to use #kw-aes256 for wrapping an RSA private key, and the 
AES 256 bit key should be derived from a user-supplied pass phrase. Do I 
simply say nothing and let the application decide where to get the AES key 
from?

Christian

[1] W3C XML-Encryption Minutes, Boston, MA, 01 March 2000
    http://www.w3.org/Encryption/2001/Minutes/0103-Boston/minutes.html