Support for SHA256?

[Cantor, Scott]

On 6/5/13 12:19 PM, "Lukas Österreicher" <lukas.oesterreicher at inode.at>
wrote:
>
>I was wondering if opensaml can support signatures with SHA256withRSA
>instead of SHA1withRSA.

XML for sure, but you're asking about SAML redirects.

>I took a look at the detection of the SigAlg URL in
>BasicSecurityConfiguration
>(using getSignatureAlgorithmURI which in turn is called (at least in
>my case) HTTPRedirectDeflateEncoder.getSignatureAlgorithmURI) and it
>appears the detection is just based on the Algorithm of the Key
>wich is just "RSA" in the typical case.
>So it would not even allow distinguishing between hash algorithms.

Could be that's a bug, I'd suggest filing it in jira and Brent or I will
take a look.

>On the other hand, when I just went ahead and used a SHA256withRSA
>Signature my unit tests (covering SAML login and logout) ran through
>correctly.
>Was SHA256 actually used and just the SigAlg paramter is incorrect?

If the SigAlg says SHA1, then the verifier definitely should use SHA1. So
it's possible it's broken. I'm sure that whatever it used was the same on
both ends if it passed the test. I'm not worried it's mis-verifying, but
it may not be handling the algorithm correctly on input.

(Or you're just mistaken about something, but I'm giving the benefit of
the doubt.)

-- Scott