How to validate signature that uses older XML canonicalization

[Yang, Gang CTR (US)]

Thanks for the reply, Scott. I understand the concept better now. But the reality requires us to support the inclusive c14n unfortunately.

Has anyone implemented a profile validator with OpenSAML library? Can you shed some lignts on this topic as to what a profile validator is supposed to do and how to implement one in OpenSAML library? You help is greatly appreciated.

Thanks,
Gang

________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Thursday, January 19, 2012 6:56 PM
To: Shib Dev
Subject: Re: How to validate signature that uses older XML canonicalization

On 1/19/12 5:51 PM, "Yang, Gang CTR (US)" <gang.yang.ctr at mail.mil> wrote:
>some debugging, I found OpenSAML library is complaining about the
>Transform Algorithm used by the other party's implementation. The
>Transform Algorithm used by the other party's implementation is
>"http://www.w3.org/TR/2001/REC-xml-c14n-20010315#"
> in stead of that used by OpenSAML library, which is
>"http://www.w3.org/2001/10/xml-exc-c14n#".

It's technically permissible, but strongly discouraged, to use transforms
other than the specific two identified in the specification.
Implementations are free to reject any others they find, because that
allows them to ensure that the content is properly signed. when this is
not done, or done wrong, you get wrapping attacks.

>
>Now my question is that is there a way to configure OpenSAML library to
>also accept the "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#"
>version of C14N?

Inclusive c14n as a Reference Transform in SAML is essentially wrong by
definition. It means the signature depends on the surrounding context
outside the object being signed. It's not necessarily much different in a
protocol message, but signing an assertion that way is definitely wrong.
That said, you can implement your own profile validator if you want to.
But I wouldn't.

-- Scott

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net