Replay attacks vs man in the middle

[Imran Ghory]

On 5/20/05, Martin Atkins <mart at degeneration.co.uk> wrote:
> However, surely the nonce needs to be something specific to
> that request which the *consumer* can validate?

The nonce would be generated by the consumer, passed to the id server
via the user/webbrowser, the id server would sign it along with the
rest of the message and then the consumer would validate that the the
nonce they generated was signed by the id server. I'll post a more
indepth explanation about how this contributes to security if anyone
wants one ?

Imran