Signature verification exception on Java 7

[Cantor, Scott]

On 1/30/13 1:59 AM, "Takeshi NISHIMURA" <takeshi at nii.ac.jp> wrote:
>
>Still I didn't try reproducing, but some IdPs in Japan experienced
>signature verification exceptions in Shibboleth IdP.
>
>Log:
>1:19:57.770 - ERROR [org.opensaml.xml.security.SigningUtil:250] - Error
>during signature verification java.security.SignatureException: Signature
>length not correct: got 256 but was expecting 128
>
>My thought:
>Java 7 may raise an exception when it try to verify the data with the
>certificate of different key length.
>If an SP has two certificates for signing in metadata, one with 1024bit
>key and the other with 2048bit, and also if the SP signs AuthnRequest,
>Java 7 seems to produce uncaught exceptions like this occasionally.

It appears to me that the trust engines aren't catching exceptions calling
to the verify routines in SigningUtil, so given that, I'd say you're
probably right. Please file a bug on this.

FWIW, I did catch a different case of Java 7 throwing instead of returning
a boolean, so it's not that surprising there are more.

-- Scott