How does the nonce and the timestamp get generated for hashed passwords in UsernameToken?

We need not to worry about the digest calculation in our application code - we simply need to set the password type to #PasswordDigest [or set the policy correctly as explained here] and supply the password in clear text from the password callback handler.

Inside wss4j code; will take the password in clear text and do the digest verification.