Question on Trust Engine

[CJ Binder]

I did read the documentation online which describes how to validate a signature with opensaml.

It shows two different samples(one that only validates signature and one that validates and ensures trust using trust engine)
Then it refers to a section on Trust Engines that is incomplete.

So with my current implementation using ExplicitKeySignatureTrustEngine and supplying a X509Certificate, is it truly establishing trust or is it just the same as if I didn't use the trust engine and is only validating the signature in which the documentation is misleading?


-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, March 19, 2014 11:38 AM
To: Shib Dev
Subject: Re: Question on Trust Engine

On 3/19/14, 12:01 PM, "CJ Binder" <CBinder at linoma.com> wrote:

>I want to understand better how trust is actually achieved using openSAML.

That depends on the trust engine implementation.

> 
>The xml signature in my research, shows the certificate within the 
>KeyInfo portion of the xml signature which can be used by anyone 
>receiving the xml.  So using that value simply verifies the content was 
>not changed but anyone can verify signature since the certificate is in 
>the xml?

KeyInfo is a hint, and signatures are not designed to limit the people who can verify them. A KeyInfo allows a verifier to optimize the process but it has nothing to do with trust. It is also an in band way to communicate a certificate if the trust strategy involves PKIX, which by definition presumes you don't already have the key.

> 
>Initially I assumed that the certificate in the KeyInfo was used to 
>compare the certificate I supply to the one that was signed, however 
>when I removed the certificate from the keyinfo portion and tried to 
>validate, the trust engine still validated.

Firstly, the certificate in the KeyInfo is *not* signed. KeyInfo is not part of the signature. Secondly, the trust engine you used is about verifying with an explicit key, period. The certificate means nothing, and the KeyInfo at most optimizes which of multiple keys gets tried, but in and of itself means nothing to the trust engine's rules.

>This leads me to believe it is establishing trust some other way and I 
>would like to know that way.

Did you read the javadoc?

>   Within the SignatureValue of the xml is there a sha1 fingerprint of 
>the certificate?

No.

>  I could see it comparing that to the sha1 fingerprint of  the 
>certificate supplied within BasicCredential to establish that the 
>certificate I have outside of the xml is the same as the one that 
>signed it.

The certificate has nothing to do with it, the key is all that matters. If you want to use certificate-based processing, you would have to use a PKIX trust engine.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net