Thanks Scott, you said I need to <br>1) Extract the key from signature<br>2) Verify the signature<br>3) Apply a trust engine to the key<br><br>I agree with this procedure. My question is in step 1, I need to load a metadata using MetadataProvider without verification to get the key. In step 2, I need to load the metadata again in order to do the verification. This is very in-efficient. I am looking for a more elegant way to handle step 1 and step 2. A sample code would be best.<br>
<br>Regarding step 3, if there is any wiki page to at least tell me what I need to implement, it would help me a lot.<br><br>Thanks,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Thu, Nov 1, 2012 at 4:36 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 11/1/12 6:55 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
><br>
>I understand that this question is related to what we have just<br>
>discussed. Using the key inside the signature is not secure. We should<br>
>either use PKI or other secure channel for example get the key directly.<br>
>If I want to use PKI, could you show me some sample<br>
> code if there is any? or give me some hints about what I should do? I<br>
>didn't find much information in wiki.<br>
<br>
</div>You have to let it extract the key from the signature, verify it, and then<br>
apply a trust engine to the key at that point to decide whether to trust<br>
it. Conceptually anyway.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>