<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="putmanb@shibboleth.net" id="email_putmanb@shibboleth.net" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=putmanb%40shibboleth.net" style="color:#326ca6;">Brent Putman</a>
commented on <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/improvement.png" height="16" width="16" border="0" align="absmiddle" alt="Improvement"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/SSPCPP-642'>SSPCPP-642</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/SSPCPP-642'><strong>improve generated EncryptionMethod metadata</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>Regarding what the 2 relevant specs say and mean: Being very precise (pedantic?), I don't think there's any conflict between the two. XML Encryption and SAML Metadata are referring to 2 different "Encryption Method" elements: respectively xenc:EncryptionMethod and samlmd:EncryptionMethod. It's true that the latter's content model is also defined to be type xenc:EncryptionMethodType. But they're not the same element. The xenc one defines operationally what one sees in an actual encryption instance document. The samlmd one defines an expression of capabilities in metadata. Different elements used in different contexts, so (potentially) different interpretations.</p>
<p>And in XML Encryption, there are the passages like the one Ian quoted, but he left out the context. The full relevant passages are:</p>
<blockquote>
<p>The <a href="http://www.w3.org/2009/xmlenc11#rsa-oaep" class="external-link">http://www.w3.org/2009/xmlenc11#rsa-oaep</a> identifier defines the mask generation function using the optional xenc11:MGF element of the xenc:EncryptionMethod element. If not present, the default of MGF1 with SHA1 is to be used.</p></blockquote>
<blockquote>
<p>The message digest function SHOULD be specified using the Algorithm attribute of the ds:DigestMethod child element of the xenc:EncryptionMethod element. If it is not specified, the default value of SHA1 is to be used. </p></blockquote>
<p>So they're clearly talking about the use of the children of xenc:EncryptionMethod (i.e. when you need to decrypt an instance document, what do you use if the children are missing). I don't think it necessarily generalizes to all usages of those algorithms and/or to what is meant by the similar data structure of samlmd:EncryptionMethod.</p>
<p>So they really aren't the same. Whether or not the metadata extension spec should follow the spirit of what xenc says about RSA-OAEP is another question.</p>
<p>Fwiw, I independently had the same interpretation of the metadata extension spec as Scott - that absence of the MGF and DigestMethod children of samlmd:EncryptionMethod means "unspecified" and effectively "encrypter picks". It seems more consistent with other usages of metadata. As Ian notes, in theory that's a problem. But practically I'd wager in this case most software impls and configs default to the SHA-1 variants, which are MTI. OpenSAML/IdP still do, for the interop reasons that Scott mentioned.</p>
<p>Also, re combinatorics: you guys are leaving out the xenc:OAEPparams child. I guess that's really more "data", not an algorithm, but it's conceivable that someone would express that, and use different values for different combos of DigestMethod and MGF. As Ian said: Oh dear...</p></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->