RSA-OAEP vs. RSA-OAEP-MGF1P

[Brent Putman]

On 2/3/15 12:41 PM, Cantor, Scott wrote:
> I looked at the code and the IdP in practice is following the spec's statement that absence of information doesn't mean lack of support. It will basically see no parameters coming from the EncryptionMethod in metadata and then it populates the parameters out of the IdP configuration.

Yes, and there's even a couple of flags on the config interface and the
SAML resolver which determine whether RSAOAEPParameters values should be
merged respectively between 1) multiple -Configuration instances and 2)
between metadata and configuration.

>
> The analogy here is SHA-2 for signing digests. We default to SHA-2 now, because we assume that any exceptions will have metadata indicating they only support SHA-1 to help with the migration. In a similar way, I think I assumed we'd eventually default to SHA-2 for OAEP and look for metadata for the ones that can't handle that.

Yes.

>
> The IdP now is still using SHA-1 because that's the more interoperable choice, but not because the SP doesn't have metadata saying it supports SHA-2. It is true that that will switch it sooner, so still worth talking about if we cared, but I guess that was my reasoning.

Yes.