Signing Assertion with SHA256

[Yang, Gang CTR (US)]

Hi,

I'm using OpenSAML 2.5.1 and is trying to switch the signing algorithm from SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1 to SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256. However in the log, I observed that although the Algorithm in the SignagureMethod element is rsa-sha256, but the Algorithm in the DigestMethod is still sha1 (see below). I was expecting a SHA256 digest. Am I missing something?


    ....
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod>
      <ds:Reference URI="">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform>
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
        <ds:DigestValue>m1OlXyxuncSeRVw0L7JgT552qfk=</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    ....

I would appreciate any help on this.

Thanks
Gang