In the “authentication protocol” definition, instead of “verifies possession of a token“, I’d suggest “verifies possession of one or multiple tokens” Erik. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://kantarainitiative.org/pipermail/wg-idassurance/attachments/20091026/27b5fcad/attachment.html