Etienne Urbah on 2010-03-17

• Propose requirement with title  'For Client authorization, the packaging of security credentials MUST be designed to prevent that any software component gains undue privilege by extracting only some credentials from the package'

Morris, Balazs and Etienne on 2010-04-21

• Spreadsheet ID = 19

Amsterdam meeting on 2010-04-28

• Example: A man in the middle might extract one credential from 'the package', and this should be not allowed
• Question:  Are such packages existing?  E.g. several SAML assertions in the SOAP Header
• Answer:  Set of assertions delegated with signature chain together as 'one package' - the SAML assertions (even 3) are always together signed
• Agreed YES