In StandardRequestHandler.java at line 209 we need to substitute:

combinedSecret = Base64.encode(WSTrustUtil.P_SHA1(clientSecret, serverSecret, (int) keySize / 8));

with:

combinedSecret = WSTrustUtil.P_SHA1(clientSecret, serverSecret, (int) keySize / 8);

this because the standard doesn't talk about the need to have the encrypted key base64 encoded and the remote system doesn't know if it is or not.