[JIRA] (IDP-1956) authn fails: an SP rejects SHA1 and our IdP produces a response with SHA1 digest

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *resolved* as *Invalid*

The default approach to key transport (encrypting the data encryption key) with an RSA key relies on a method called RSA-OEAP that has two pluggable digests, oone for the mask generation function and another for the padding method. Both default to SHA-1 because very little software supports SHA-2 in either place, though that is variable and probably a bit better these days than 5-7 years back.

They can be changed but it's complex to do. The "misc" example at the end of the AlgorithmFilter page has an example of forcing both of the extra digests to SHA-256 through metadata.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1274544161/AlgorithmFilter

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiYzkzOWI5NzU3MTVhNDZmMGEzNGI2ODM4YzgzMzJjNmMiLCJwIjoiaiJ9 ) / Story ( https://shibboleth.atlassian.net/browse/IDP-1956?atlOrigin=eyJpIjoiYzkzOWI5NzU3MTVhNDZmMGEzNGI2ODM4YzgzMzJjNmMiLCJwIjoiaiJ9 ) IDP-1956 ( https://shibboleth.atlassian.net/browse/IDP-1956?atlOrigin=eyJpIjoiYzkzOWI5NzU3MTVhNDZmMGEzNGI2ODM4YzgzMzJjNmMiLCJwIjoiaiJ9 ) authn fails: an SP rejects SHA1 and our IdP produces a response with SHA1 digest ( https://shibboleth.atlassian.net/browse/IDP-1956?atlOrigin=eyJpIjoiYzkzOWI5NzU3MTVhNDZmMGEzNGI2ODM4YzgzMzJjNmMiLCJwIjoiaiJ9 )

Change By: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Assignee: Brent Putman Unassigned Resolution: Invalid Status: Open Resolved

( https://shibboleth.atlassian.net/browse/IDP-1956#add-comment?atlOrigin=eyJpIjoiYzkzOWI5NzU3MTVhNDZmMGEzNGI2ODM4YzgzMzJjNmMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1956#add-comment?atlOrigin=eyJpIjoiYzkzOWI5NzU3MTVhNDZmMGEzNGI2ODM4YzgzMzJjNmMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:f4460c0 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/0a0ea60b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d3929841-a61e-4331-9a8e-c13eed52b278
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/0a0ea60b/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-story-b97b509a-0db0-4360-b551-a993eb9190c0
Type: image/png
Size: 369 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/0a0ea60b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-ee28e794-3365-422f-a4dd-ad2460925726
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/0a0ea60b/attachment-0005.png>