Changes

Backed Identity Assertions MUST SHOULD NOT be verified in the client, in JavaScript or otherwise, since client runtimes may be altered to circumvent such verification. Instead, Backed Identity Assertions SHOULD be sent to a trusted server for verification.

To verify an a Backed Identity Assertion, a Relying Party MUST SHOULD perform the following checks:# If the valid-until <tt>exp</tt> date of the assertion is earlier than the current timeby more than a certain interval, the assertion has expired and must be rejected.# If A Relying Party MAY choose the nonce in the assertion has previously been received by the relying partylength of that interval, the assertion has been used and must though it is recommended that it be rejectedless than 5 minutes.# If the <tt>audience </tt> field of the assertion does not match the full domain Relying Party's origin (including scheme and optional non-standard port) of the page that requested the Identity Assertion, reject the assertion must be rejected. Note that implementations MUST include the scheme and non-standard port, if any, in the match check. A domain that includes the standard port, of 80 for HTTP and 443 for HTTPS, MUST SHOULD be treated as equivalent to a domain that matches the protocol but does not include the port. (XXX: Can we find an RFC that defines this equality test?)# The If the Identity Assertion's signature over does not verify against the public-key within the last Identity Certificate, reject the assertion must be verified with .# If there is more than one Identity Certificate, then reject the assertion unless each certificate after the first one is properly signed by the prior certificate's public key.# If the first certificate (or only certificate when there is only one) is not properly signed by the expected issuer's public key contained , reject the assertion. The expected issuer is either the domain of the certified email address in the last certificate, or the issuer listed in the first certificateif the email-address domain does not support BrowserID.# WORK HERE