Signature verification exception on Java 7

[Takeshi NISHIMURA]

Hi Scott,

Thanks for your inspection. I did.
https://issues.shibboleth.net/jira/browse/SIDP-573

Sincerely,
Takeshi

On 2013/01/31, at 0:38, Cantor, Scott wrote:

> On 1/30/13 1:59 AM, "Takeshi NISHIMURA" <takeshi at nii.ac.jp> wrote:
>> 
>> Still I didn't try reproducing, but some IdPs in Japan experienced
>> signature verification exceptions in Shibboleth IdP.
>> 
>> Log:
>> 1:19:57.770 - ERROR [org.opensaml.xml.security.SigningUtil:250] - Error
>> during signature verification java.security.SignatureException: Signature
>> length not correct: got 256 but was expecting 128
>> 
>> My thought:
>> Java 7 may raise an exception when it try to verify the data with the
>> certificate of different key length.
>> If an SP has two certificates for signing in metadata, one with 1024bit
>> key and the other with 2048bit, and also if the SP signs AuthnRequest,
>> Java 7 seems to produce uncaught exceptions like this occasionally.
> 
> It appears to me that the trust engines aren't catching exceptions calling
> to the verify routines in SigningUtil, so given that, I'd say you're
> probably right. Please file a bug on this.
> 
> FWIW, I did catch a different case of Java 7 throwing instead of returning
> a boolean, so it's not that surprising there are more.
> 
> -- Scott