Signing Assertion with SHA256

[Yang, Gang CTR (US)]

Got it. Thanks, Scott! My apology - I got the names messed up. We happen to be also using OpenAM, an identity management product that supports SSO and federation. It used to be called OpenSSO by Sun.

Thanks again.
Gang
________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Monday, January 13, 2014 3:46 PM
To: Shib Dev
Subject: Re: Signing Assertion with SHA256

On 1/13/14, 3:37 PM, "Yang, Gang CTR (US)" <gang.yang.ctr at mail.mil> wrote:

>Any one happen to know where SHA256 was defined? Within OpenAM libraries
>or ourside?

I don't know what OpenAM is.

The constant here is in the EncryptionConstants class because that's the
spec that happened to define it. In V3, it's aliased across to signature
constants for convenience, I believe.

>I also observed, after changing the reference digest method, that the
>algorithm for the <DigestMethod> of <EncryptionMethod> in encrypted
>assertion is also still using SHA1.

That's a different use case and has nothing to do with signing.

> So another place that need changes. What's the right way to change the
>digest method across the board in OpenSAML?

There isn't one. Different use cases use different settings. I suspect
almost nothing supports non-SHA1 OAEP encryption padding anyway, and if
you changed that, the mask function is still SHA-1 based because that's
something else again.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net