<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="ian@iay.org.uk" id="email_ian@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=ian%40iay.org.uk" style="color:#326ca6;">Ian Young</a>
edited a comment on <img src="https://issues.shibboleth.net/jira/images/icons/newfeature.gif" height="16" width="16" border="0" align="absmiddle" alt="New Feature"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/XSTJ-14'>XSTJ-14</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/XSTJ-14'><strong>Feature to Allow User to Specify Digest and Signature Algorithm to use when signing metadata</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>Assigning to myself, at least for now, as I want to experiment with some of this to try and get some idea about compatibility but potentially for UKf deployment.</p>
<p>Initial implementation notes:</p>
<p>There are two steps in an XML signature, each of which has a URI associated with it.</p>
<p>The "inner" digest of the referenced document is hard-wired within the XMLSecTool CLI as SHA-1.</p>
<p>The "outer" digest-and-sign URI is provided from XMLTooling's default as RSA+SHA-1 for any RSA signing credential (others are used for other credential types, which I suppose means DSA in practice).</p>
<p>The "outer" digest algorithm needs to be compatible with the signing credential; in particular, the result plus some gubbins needs to be smaller than the RSA modulus. This would rule out, for example, SHA-512 with a 512-bit signing key. That's a pretty unlikely combination, though, so perhaps it can be ignored or simply allowed to fail through normal channels.</p>
<p>I think the inner and outer digest functions could theoretically be different (for example, the signature algorithm could be RSA+SHA-1 while the inner digest could be SHA-512) but it's not clear why you'd want to do that.</p>
<p>Providing command line parameters to allow the two digest algorithms to be overridden individually would be very easy to do but very ugly in operation and prone to errors which would make the result less secure than you think, for example, by overriding just the inner digest function with SHA-512 and leaving the outer algorithm as RSA+SHA-1.</p>
<p>It would be more complicated to provide a numeric command-line parameter determining <b>both</b> hash functions, but it would be a better UI in a lot of ways. It would probably mean putting a lot more logic and knowledge of the URIs into the XMLSecTool CLI, though, to make sure that the right outer algorithm was chosen in each case. There may be a class somewhere out there already that can do that, though, which we can use.</p></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->