Signing multiple objects?

[Cantor, Scott]

On 10/24/11 8:51 PM, "Brad Cox" <bradjcox at gmail.com> wrote:

>I'm trying to meet stringent DOD security requirements that require that
>several elements in the headers be signed. Actually the body too, but
>presumably just the payload but am not sure, so I've left body signing
>aside for now). For example, the Timestamp, MessageID, and SAML Assertion
>should all be signed.

It's extremely complex to do that in a way that isn't vulnerable to
wrapping attacks. You need XPath or a lot of control over the application
on both ends.

>I have Assertion signing working now, but am stumped on Timestamp and
>MessageID since these come from xmltooling and don't comply with
>SignableSAMLObject.

I don't believe there is any built-in support for WS-Security message
signatures. We haven't ever analyzed how it would be handled or how to
make it safe.

The safest thing is to sign the whole message. A whole document reference
isn't usable with SOAP intermediaries, but it is secure.

-- Scott