[cpp-opensaml] branch master updated: SSPCPP-805 - Change default signing algorithms to SHA-256

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=9c7db1564692bdde7417a002455eb7cb2cb701ca

The following commit(s) were added to refs/heads/master by this push:
       new  9c7db15   SSPCPP-805 - Change default signing algorithms to SHA-256
9c7db15 is described below

commit 9c7db1564692bdde7417a002455eb7cb2cb701ca
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 24 17:58:30 2018 -0400

    SSPCPP-805 - Change default signing algorithms to SHA-256
    
    https://issues.shibboleth.net/jira/browse/SSPCPP-805
    
    Change ContentReference and simple signing defaults.
    Revise SHA-2 detection logic to leverage underlying lib.
---
 saml/internal.h                                  |  1 +
 saml/saml2/binding/impl/SAML2POSTEncoder.cpp     |  7 ++++++-
 saml/saml2/binding/impl/SAML2RedirectEncoder.cpp |  7 ++++++-
 saml/signature/ContentReference.cpp              | 19 ++++++++++++++++---
 4 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/saml/internal.h b/saml/internal.h
index 1e43ce8..9e89574 100644
--- a/saml/internal.h
+++ b/saml/internal.h
@@ -29,6 +29,7 @@
 # define _CRT_SECURE_NO_DEPRECATE 1
 # define _CRT_NONSTDC_NO_DEPRECATE 1
 # define _SCL_SECURE_NO_WARNINGS 1
+# define XSEC_HAVE_OPENSSL 1
 #endif
 
 // Export public APIs
diff --git a/saml/saml2/binding/impl/SAML2POSTEncoder.cpp b/saml/saml2/binding/impl/SAML2POSTEncoder.cpp
index b66547b..583cf41 100644
--- a/saml/saml2/binding/impl/SAML2POSTEncoder.cpp
+++ b/saml/saml2/binding/impl/SAML2POSTEncoder.cpp
@@ -194,8 +194,13 @@ long SAML2POSTEncoder::encode(
         string input = (request ? "SAMLRequest=" : "SAMLResponse=") + msg;
         if (relayState && *relayState)
             input = input + "&RelayState=" + relayState;
-        if (!signatureAlg)
+        if (!signatureAlg) {
+#ifdef XSEC_OPENSSL_HAVE_SHA2
+            signatureAlg = DSIGConstants::s_unicodeStrURIRSA_SHA256;
+#else
             signatureAlg = DSIGConstants::s_unicodeStrURIRSA_SHA1;
+#endif
+        }
         auto_ptr_char alg(signatureAlg);
         pmap.m_map["SigAlg"] = alg.get();
         input = input + "&SigAlg=" + alg.get();
diff --git a/saml/saml2/binding/impl/SAML2RedirectEncoder.cpp b/saml/saml2/binding/impl/SAML2RedirectEncoder.cpp
index bb86386..72ceea7 100644
--- a/saml/saml2/binding/impl/SAML2RedirectEncoder.cpp
+++ b/saml/saml2/binding/impl/SAML2RedirectEncoder.cpp
@@ -158,8 +158,13 @@ long SAML2RedirectEncoder::encode(
         log.debug("signing the message");
         
         // Sign the query string after adding the algorithm.
-        if (!signatureAlg)
+        if (!signatureAlg) {
+#ifdef XSEC_OPENSSL_HAVE_SHA2
+            signatureAlg = DSIGConstants::s_unicodeStrURIRSA_SHA256;
+#else
             signatureAlg = DSIGConstants::s_unicodeStrURIRSA_SHA1;
+#endif
+        }
         auto_ptr_char alg(signatureAlg);
         xmlbuf = xmlbuf + "&SigAlg=" + escaper->encode(alg.get());
 
diff --git a/saml/signature/ContentReference.cpp b/saml/signature/ContentReference.cpp
index 41f88eb..2624d3a 100644
--- a/saml/signature/ContentReference.cpp
+++ b/saml/signature/ContentReference.cpp
@@ -71,15 +71,28 @@ void ContentReference::createReferences(DSIGSignature* sig)
     DSIGReference* ref = nullptr;
     sig->setIdByAttributeName(false);
     const XMLCh* id=m_signableObject.getXMLID();
-    if (!id || !*id)
-        ref=sig->createReference(&chNull, m_digest ? m_digest : DSIGConstants::s_unicodeStrURISHA1);  // whole doc reference
+    if (!id || !*id) {
+        ref = sig->createReference(&chNull, 
+#ifdef XSEC_OPENSSL_HAVE_SHA2
+            m_digest ? m_digest : DSIGConstants::s_unicodeStrURISHA256
+#else
+            m_digest ? m_digest : DSIGConstants::s_unicodeStrURISHA1
+#endif
+            );  // whole doc reference
+    }
     else {
         XMLCh* buf=new XMLCh[XMLString::stringLen(id) + 2];
         auto_arrayptr<XMLCh> bufjanitor(buf);
         buf[0]=chPound;
         buf[1]=chNull;
         XMLString::catString(buf,id);
-        ref=sig->createReference(buf, m_digest ? m_digest : DSIGConstants::s_unicodeStrURISHA1);
+        ref=sig->createReference(buf,
+#ifdef XSEC_OPENSSL_HAVE_SHA2
+            m_digest ? m_digest : DSIGConstants::s_unicodeStrURISHA256
+#else
+            m_digest ? m_digest : DSIGConstants::s_unicodeStrURISHA1
+#endif
+            );
     }
     
     ref->appendEnvelopedSignatureTransform();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.