/// <summary>
        /// Inherited from <see cref="SecurityTokenResolver"/>.
        /// </summary>
        protected override bool TryResolveSecurityKeyCore( SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key )
        {
            if ( keyIdentifierClause == null )
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "keyIdentifierClause" );
            }

            key = null;

            X509RawDataKeyIdentifierClause rawDataClause = keyIdentifierClause as X509RawDataKeyIdentifierClause;
            if ( rawDataClause != null )
            {
                key = rawDataClause.CreateKey();
                return true;
            }

            RsaKeyIdentifierClause rsaClause = keyIdentifierClause as RsaKeyIdentifierClause;
            if ( rsaClause != null )
            {
                key = rsaClause.CreateKey();
                return true;
            }

            if ( _wrappedTokenResolver.TryResolveSecurityKey( keyIdentifierClause, out key ) )
            {
                return true;
            }

            return false;
        }

 public override void WriteKeyIdentifierClauseCore(XmlDictionaryWriter writer, SecurityKeyIdentifierClause keyIdentifierClause)
 {
     EncryptedKeyIdentifierClause clause = keyIdentifierClause as EncryptedKeyIdentifierClause;
     writer.WriteStartElement(XD.XmlEncryptionDictionary.Prefix.Value, XD.XmlEncryptionDictionary.EncryptedKey, this.NamespaceUri);
     if (clause.EncryptionMethod != null)
     {
         writer.WriteStartElement(XD.XmlEncryptionDictionary.Prefix.Value, XD.XmlEncryptionDictionary.EncryptionMethod, this.NamespaceUri);
         writer.WriteAttributeString(XD.XmlEncryptionDictionary.AlgorithmAttribute, null, clause.EncryptionMethod);
         if (clause.EncryptionMethod == XD.SecurityAlgorithmDictionary.RsaOaepKeyWrap.Value)
         {
             writer.WriteStartElement("", XD.XmlSignatureDictionary.DigestMethod, XD.XmlSignatureDictionary.Namespace);
             writer.WriteAttributeString(XD.XmlSignatureDictionary.Algorithm, null, "http://www.w3.org/2000/09/xmldsig#sha1");
             writer.WriteEndElement();
         }
         writer.WriteEndElement();
     }
     if (clause.EncryptingKeyIdentifier != null)
     {
         this.tokenSerializer.WriteKeyIdentifier(writer, clause.EncryptingKeyIdentifier);
     }
     writer.WriteStartElement(XD.XmlEncryptionDictionary.Prefix.Value, XD.XmlEncryptionDictionary.CipherData, this.NamespaceUri);
     writer.WriteStartElement(XD.XmlEncryptionDictionary.Prefix.Value, XD.XmlEncryptionDictionary.CipherValue, this.NamespaceUri);
     byte[] encryptedKey = clause.GetEncryptedKey();
     writer.WriteBase64(encryptedKey, 0, encryptedKey.Length);
     writer.WriteEndElement();
     writer.WriteEndElement();
     if (clause.CarriedKeyName != null)
     {
         writer.WriteElementString(XD.XmlEncryptionDictionary.Prefix.Value, XD.XmlEncryptionDictionary.CarriedKeyName, this.NamespaceUri, clause.CarriedKeyName);
     }
     writer.WriteEndElement();
 }

 internal DerivedKeySecurityToken(int generation, int offset, int length, string label, byte[] nonce, SecurityToken tokenToDerive, SecurityKeyIdentifierClause tokenToDeriveIdentifier, string derivationAlgorithm, string id)
 {
     this.length = -1;
     this.offset = -1;
     this.generation = -1;
     this.Initialize(id, generation, offset, length, label, nonce, tokenToDerive, tokenToDeriveIdentifier, derivationAlgorithm, false);
 }

		public override bool Matches (SecurityKeyIdentifierClause keyIdentifierClause)
		{
			InternalEncryptedKeyIdentifierClause kic = keyIdentifierClause as InternalEncryptedKeyIdentifierClause;
			if (kic == null)
				return false;
			return Matches (kic.GetRawBuffer ());
		}

		public override bool Matches (
			SecurityKeyIdentifierClause keyIdentifierClause)
		{
			SecurityContextKeyIdentifierClause other =
				keyIdentifierClause as SecurityContextKeyIdentifierClause;
			return  other != null && Matches (other.context, other.generation);
		}

		public DerivedKeySecurityToken (string id, string algorithm,
			SecurityKeyIdentifierClause reference,
			SymmetricSecurityKey referencedKey,
			string name,
			int? generation,
			int? offset,
			int? length,
			string label,
			byte [] nonce)
		{
			algorithm = algorithm ?? SecurityAlgorithms.Psha1KeyDerivation;

			this.id = id;
			this.algorithm = algorithm;
			this.reference = reference;
			this.generation = generation;
			this.offset = offset;
			this.length = length;
			this.nonce = nonce;
			this.name = name;
			this.label = label;

			SecurityKey key = new InMemorySymmetricSecurityKey (
				referencedKey.GenerateDerivedKey (
					algorithm,
					Encoding.UTF8.GetBytes (label ?? Constants.WsscDefaultLabel),
					nonce,
					(length ?? 32) * 8,
					offset ?? 0));
			keys = new ReadOnlyCollection<SecurityKey> (
				new SecurityKey [] {key});
		}

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            SamlAssertionDirectKeyIdentifierClause that = keyIdentifierClause as SamlAssertionDirectKeyIdentifierClause;

            // PreSharp Bug: Parameter 'that' to this public method must be validated: A null-dereference can occur here.
#pragma warning suppress 56506
            return (ReferenceEquals(this, that) || (that != null && that.SamlUri == this.SamlUri));
        }

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            BinaryKeyIdentifierClause that = keyIdentifierClause as BinaryKeyIdentifierClause;

            // PreSharp 
            #pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.identificationData));
        }

		public override bool Matches (SecurityKeyIdentifierClause clause)
		{
			if (clause == null)
				throw new ArgumentNullException ("clause");
			KeyNameIdentifierClause knic =
				clause as KeyNameIdentifierClause;
			return knic != null && Matches (knic.KeyName);
		}

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            RsaKeyIdentifierClause that = keyIdentifierClause as RsaKeyIdentifierClause;

            // PreSharp Bug: Parameter 'that' to this public method must be validated: A null-dereference can occur here.
            #pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.rsa));
        }

		public override bool Matches (SecurityKeyIdentifierClause clause)
		{
			if (clause == null)
				throw new ArgumentNullException ("clause");
			LocalIdKeyIdentifierClause c =
				clause as LocalIdKeyIdentifierClause;
			return c != null && Matches (c.LocalId, c.OwnerType);
		}

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            GenericXmlSecurityKeyIdentifierClause that = keyIdentifierClause as GenericXmlSecurityKeyIdentifierClause;

            // PreSharp 
#pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.ReferenceXml));
        }

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            LocalIdKeyIdentifierClause that = keyIdentifierClause as LocalIdKeyIdentifierClause;

            // PreSharp 
#pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.localId, this.OwnerType));
        }

		public override bool Matches (SecurityKeyIdentifierClause clause)
		{
			if (clause == null)
				throw new ArgumentNullException ("clause");
			RsaKeyIdentifierClause rkic =
				clause as RsaKeyIdentifierClause;
			return rkic != null && Matches (rkic.Rsa);
		}

		public static string GetKeyIdentifierClauseXml (SecurityTokenSerializer serializer, XmlWriterSettings settings, SecurityKeyIdentifierClause item)
		{
			StringWriter sw = new StringWriter ();
			using (XmlWriter xw = XmlWriter.Create (sw)) {
				serializer.WriteKeyIdentifierClause (xw, item);
			}
			return sw.ToString ();
		}

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            X509IssuerSerialKeyIdentifierClause that = keyIdentifierClause as X509IssuerSerialKeyIdentifierClause;

            // PreSharp 
#pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.issuerName, this.issuerSerialNumber));
        }

 public bool CanWriteKeyIdentifierClause(SecurityKeyIdentifierClause keyIdentifierClause)
 {
     if (keyIdentifierClause == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifierClause");
     }
     return this.CanWriteKeyIdentifierClauseCore(keyIdentifierClause);
 }

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            SecurityContextKeyIdentifierClause that = keyIdentifierClause as SecurityContextKeyIdentifierClause;

            // PreSharp 
            #pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.contextId, this.generation));
        }

		public override bool Matches (SecurityKeyIdentifierClause clause)
		{
			BinaryKeyIdentifierClause other =
				clause as BinaryKeyIdentifierClause;
			if (other == null)
				return false;
			return Matches (other.GetRawBuffer ());
		}

        public override bool Matches(SecurityKeyIdentifierClause keyIdentifierClause)
        {
            EncryptedKeyIdentifierClause that = keyIdentifierClause as EncryptedKeyIdentifierClause;

            // PreSharp Bug: Parameter 'that' to this public method must be validated: A null-dereference can occur here.
            #pragma warning suppress 56506
            return ReferenceEquals(this, that) || (that != null && that.Matches(this.GetRawBuffer(), this.encryptionMethod, this.carriedKeyName));
        }