Considering blacklist of PKCS 1.5 in SP 2.5

[Cantor, Scott]

On 7/27/12 2:07 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>Is there a configuration element I can add to the blacklist configuration
>that will allow me to try it out ahead of time and see if there are any
>impacts to the SPs I currently support?

Just add the value http://www.w3.org/2001/04/xmlenc#rsa-1_5 to the list in
the <AlgorithmBlacklist> element in security-policy.xml (or I guess to the
original element in shibboleth2.xml in older configs).

Unless your SPs are accepting traffic from a non-Shibboleth IdP, there's
no possibility of an issue. If they are, then it's worth trying.

Also, only Linux/RPM installs will see this change on an upgrade because
none of the other installation mechanisms update unchanged config files.

Obviously if you distribute your own files, you can change this
immediately for new installs, the blacklist isn't a new feature. If you
were really ambitious, you could even choose to control this centrally by
distributing a signed file and configuring SPs to load it from a URL (like
metadata). That's starting to look more and more advisable thse days.


-- Scott