Question on Trust Engine

[Cantor, Scott]

On 3/19/14, 12:01 PM, "CJ Binder" <CBinder at linoma.com> wrote:

>I want to understand better how trust is actually achieved using openSAML.

That depends on the trust engine implementation.

> 
>The xml signature in my research, shows the certificate within the
>KeyInfo portion of the xml signature which can be used by anyone
>receiving the xml.  So using that value simply verifies the content was
>not changed but anyone can verify signature since the certificate is in
>the xml?

KeyInfo is a hint, and signatures are not designed to limit the people who
can verify them. A KeyInfo allows a verifier to optimize the process but
it has nothing to do with trust. It is also an in band way to communicate
a certificate if the trust strategy involves PKIX, which by definition
presumes you don't already have the key.

> 
>Initially I assumed that the certificate in the KeyInfo was used to
>compare the certificate I supply to the one that was signed, however when
>I removed the certificate from the keyinfo portion and tried to validate,
>the trust engine still validated.

Firstly, the certificate in the KeyInfo is *not* signed. KeyInfo is not
part of the signature. Secondly, the trust engine you used is about
verifying with an explicit key, period. The certificate means nothing, and
the KeyInfo at most optimizes which of multiple keys gets tried, but in
and of itself means nothing to the trust engine's rules.

>This leads me to believe it is establishing trust some other way and I
>would like to know that way.

Did you read the javadoc?

>   Within the SignatureValue of the xml is there a sha1 fingerprint of
>the certificate?

No.

>  I could see it comparing that to the sha1 fingerprint of
> the certificate supplied within BasicCredential to establish that the
>certificate I have outside of the xml is the same as the one that signed
>it.

The certificate has nothing to do with it, the key is all that matters. If
you want to use certificate-based processing, you would have to use a PKIX
trust engine.

-- Scott