On Breaking SAML

[Ian Young]

On 10 Aug 2012, at 14:44, Tom Scavo <trscavo at gmail.com> wrote:

> I assume you've already heard about this, but just in case you haven't:
> 
> http://www.nds.rub.de/research/publications/BreakingSAML/
> 
> Shibboleth is mentioned (implicated?) in this research paper.

This isn't news, but the formal publication of the wrapping attack that was dealt with in Shibboleth and other software in July of last year.[1]

Publication cycles for papers in this area can be pretty extended, but these particular researchers have been in touch with various people involved with implementations for some time.

	-- Ian


[1] http://shibboleth.net/community/advisories/secadv_20110725.txt

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20120810/f88b947b/attachment-0001.bin