RSA-OAEP vs. RSA-OAEP-MGF1P

[Cantor, Scott]

> I think the IdP just defaults to SHA-1 now because of interop, so I'm not sure
> it's explicitly interpreting anything, you wouldn't be able to tell really. In other
> words, I don't think it's looking for opportunities to use SHA-2, but I could be
> wrong.

I looked at the code and the IdP in practice is following the spec's statement that absence of information doesn't mean lack of support. It will basically see no parameters coming from the EncryptionMethod in metadata and then it populates the parameters out of the IdP configuration.

The analogy here is SHA-2 for signing digests. We default to SHA-2 now, because we assume that any exceptions will have metadata indicating they only support SHA-1 to help with the migration. In a similar way, I think I assumed we'd eventually default to SHA-2 for OAEP and look for metadata for the ones that can't handle that.

The IdP now is still using SHA-1 because that's the more interoperable choice, but not because the SP doesn't have metadata saying it supports SHA-2. It is true that that will switch it sooner, so still worth talking about if we cared, but I guess that was my reasoning.

-- Scott