<div dir="ltr">The openid.response_nonce won't be helpful here. If your RP can work only with HTTPS OP endpoints, and if your RP has an https:// return_to address, then you're already golden. The authenticating user will have the opportunity to see the information flash by in transit, but no one else will, and presumably this information isn't to be held private against the user himself! :)<br>
<br><div class="gmail_quote">On Sun, Aug 3, 2008 at 11:51 AM, SitG Admin <span dir="ltr"><<a href="mailto:sysadmin@shadowsinthegarden.com">sysadmin@shadowsinthegarden.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">>I'd like to transmit sensitive data over the Attribute Exchange<br>
>Extension and was wondering about the best way for encryption.<br>
<br>
</div>Could you use the nonce for encryption? I assume here, of course,<br>
that the nonce has already been encrypted during the OpenID exchange<br>
(I'm not strong on the technical aspects of this).<br>
<br>
-Shade<br>
<div><div></div><div class="Wj3C7c">_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@openid.net">general@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
</div></div></blockquote></div><br></div>