Support for SHA256?

[Cantor, Scott]

On 6/5/13 1:40 PM, "Lukas Österreicher" <lukas.oesterreicher at inode.at>
wrote:

>- The certificate (and pkcs12 derived from it and the key) are based
>on SHA256 and that also shows up when I debug in to the loaded cert.

Well, that means nothing, actually. The hash algorithm used in a
certificate has nothing to do with anything you're talking about here with
signature algorithms. They're totally separate issues.

>- The class previously mentioned seemes ill equipped to handle more
>than SHA1. All algorithms mentioned in the map containing SigAlgs are
>specific to SHA1

Ok, now I know why you'e confused (and no, it's not a bug). The current
code base derives the algorithm to use from the credential, and it picks
that based on the security configuration information. If you want to use
SHA-2, you have to supply an alternative SecurityConfiguration in the
appropriate spots to get it to decide on a different algorithm to use.

With an OpenSAML app, you can do this programmatically (don't ask, I don't
know how, check the archives or wiki, or wait for Brent to response). I
believe the bean example JeffK posted from Brent is an example of part of
that.

>I am not sure however if it is even possible to sign with SHA1 hashes
>if the signature and private key are SHA256.

Keys don't have "SHA256" associated with them. The digest is totally
independent of a key. You would need to go read up on how RSA signing
works if you want to understand all this.

>If it is possible however then it may mean that SHA1 is always used no
>matter what.

Yes. There was nothing you did that provided SHA-256 as an alternative to
use, that's what confused me. You are confusing certificate handling with
signatures.

>I'll do some further debugging to see if I can find out more.

No need.

>I'll also see to it to raise a Bug since SHA256 should be supported.

Do not (it is supported, just not that elegantly).

>Maybe you can give me further hints on how to find out what's actually
>happening and what I can do from my side (try out work-arounds or
>provide you more data)?

What's happening is you didn't supply an alternative security
configuration, and that's the only way to override the global algorithm
defaults.

-- Scott