Signing Assertion with SHA256

[Cantor, Scott]

On 1/13/14, 3:37 PM, "Yang, Gang CTR (US)" <gang.yang.ctr at mail.mil> wrote:

>Any one happen to know where SHA256 was defined? Within OpenAM libraries
>or ourside?

I don't know what OpenAM is.

The constant here is in the EncryptionConstants class because that's the
spec that happened to define it. In V3, it's aliased across to signature
constants for convenience, I believe.

>I also observed, after changing the reference digest method, that the
>algorithm for the <DigestMethod> of <EncryptionMethod> in encrypted
>assertion is also still using SHA1.

That's a different use case and has nothing to do with signing.

> So another place that need changes. What's the right way to change the
>digest method across the board in OpenSAML?

There isn't one. Different use cases use different settings. I suspect
almost nothing supports non-SHA1 OAEP encryption padding anyway, and if
you changed that, the mask function is still SHA-1 based because that's
something else again.

-- Scott