Signing Assertion with SHA256

[Yang, Gang CTR (US)]

Scott,

Thanks for pointing out this. I reviewed XML-Signature and indeed an extra digest are generated for each reference before SginedInfo is signed, which generates the encrypted digest of the SignedInfo as the SignatureValue.

However, I'm having a hard time to find the OpenSAML API to set the digest method for the reference. In my code, I first obtain the org.opensaml.xml.signature.Signature, which allows me to set only the signature algorithm and canonicalization algorithm. Then after associating the signature object with the SAML object, I call Singer.sigObject(Signature) to sign the SAML object, where I don't seem to have a chance to set the digest method for the references. Can some one provide a pointer or help?

Thanks,
Gang
________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Saturday, January 11, 2014 2:09 PM
To: Shib Dev
Subject: Re: Signing Assertion with SHA256

On 1/10/14, 5:58 PM, "Yang, Gang CTR (US)" <gang.yang.ctr at mail.mil> wrote:
>
>I'm using OpenSAML 2.5.1 and is trying to switch the signing algorithm
>from SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1 to
>SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256. However in the log, I
>observed that although the Algorithm in the SignagureMethod element is
>rsa-sha256, but the Algorithm in the DigestMethod is still sha1 (see
>below). I was expecting a SHA256 digest. Am I missing something?

Signing and digest algorithms are independently controlled in XML
Signature. The signature is over the SignedInfo element and the references
are independently digested.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net