Signature verification exception on Java 7

[Takeshi NISHIMURA]

Hi all,

Still I didn't try reproducing, but some IdPs in Japan experienced signature verification exceptions in Shibboleth IdP.

Log:
1:19:57.770 - ERROR [org.opensaml.xml.security.SigningUtil:250] - Error during signature verification java.security.SignatureException: Signature length not correct: got 256 but was expecting 128

My thought:
Java 7 may raise an exception when it try to verify the data with the certificate of different key length.
If an SP has two certificates for signing in metadata, one with 1024bit key and the other with 2048bit,
and also if the SP signs AuthnRequest, Java 7 seems to produce uncaught exceptions like this occasionally.

Does anyone see this error message?

Sincerely,
Takeshi