On 3/25/07, Tom Scavo <trsc...@gmail.com> wrote:

To summarize, the following normative changes were made in draft-12:

1. The profile identifiers were changed.

OLD: urn:oasis:names:tc:SAML:profiles:query:attributes:X509-basic NEW: urn:oasis:names:tc:SAML:2.0:profiles:query:attribute:X509-basic

OLD: urn:oasis:names:tc:SAML:profiles:query:attributes:X509-encrypted NEW: urn:oasis:names:tc:SAML:2.0:profiles:query:attribute:X509-encrypted

2. The following sentence was added to section 4.2.2 (Use of Encryption):

A symmetric key transmitted in an <xenc:EncryptedKey> element MUST NOT be later reused by the service provider as a previously established symmetric key.

3. The mixing of encrypted and unencrypted assertions is prohibited in Encrypted Mode.

4. The following line was deleted in section 4.2.2 (Use of Encryption):

This procedure MUST be supported by the service provider.

Likewise the following line was deleted in 4.3.2 (Use of Encryption):

This procedure MUST be supported by the identity provider.

5. Both the assertion and response MUST be signed in section 4.3.3 (Use of Digital Signatures).

Tom