Support for SHA256?

[Krug, Jeff]

Is this within the Shibboleth IDP?  Or a custom opensaml application?  Or perhaps the Shibboleth SP?

If this is for the Shibboleth IDP, there is an extension that is easy to update for your use case that was 
posted awhile back.  I sadly don't remember who put this up, but I have been using it for awhile 
(so thanks!):

https://www.middleware.georgetown.edu/idp-crypto-config/

Then if you want ot use SHA-256 intead of SHA-1 with RSA, you would add the following lines:

            log.info("Overriding global OpenSAML digital signature algoriithm URI (RSA with SHA1) to: {}",
                    SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
     
             secConfig.registerSignatureAlgorithmURI("RSA", SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);     


(And by the way, the example functionality in the library has become a security degradation, as you should not be using RSA15 for key transport any longer, so be sure to comment out those two lines before adding your custom code if you use the library)



________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Lukas Österreicher [lukas.oesterreicher at inode.at]
Sent: Wednesday, June 05, 2013 12:19 PM
To: dev at shibboleth.net
Subject: Support for SHA256?

Hi.

Peter Schober asked me to post this question here instead of the users
mailinglist:

I was wondering if opensaml can support signatures with SHA256withRSA
instead of SHA1withRSA.

I took a look at the detection of the SigAlg URL in BasicSecurityConfiguration
(using getSignatureAlgorithmURI which in turn is called (at least in
my case) HTTPRedirectDeflateEncoder.getSignatureAlgorithmURI) and it
appears the detection is just based on the Algorithm of the Key
wich is just "RSA" in the typical case.
So it would not even allow distinguishing between hash algorithms.

On the other hand, when I just went ahead and used a SHA256withRSA
Signature my unit tests (covering SAML login and logout) ran through correctly.
Was SHA256 actually used and just the SigAlg paramter is incorrect?

Thanx in advance,
Lukas

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net