Thanks for you answers Brent and Scott.<br><br>Can I dig one more step further? I don't really understand how step c is done. To me in order to finish step c, we need the string of the whole assertion, otherwise we won't be able to construct the digest value. Is the string part of the Signature object stored in some private field? Can you point out which field? or which part of the code do this?<br>
<br><br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Tue, Nov 6, 2012 at 2:54 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 11/6/12 5:47 PM, Yaowen Tu wrote:<br>
> Scott maybe I should have asked it in another way:<br>
><br>
> When SP tries to validate the signature, theoretically it needs to:<br>
> a. make sure the certificate of IdP really belongs to the IdP.<br>
> This is done by trust engine.<br>
<br>
</div>Yes, by either our TrustEngine/SignaureTrustEngine, or a some other code<br>
that performs the same function.<br>
<div class="im"><br>
<br>
> b. make sure the signature is generated by the private key of<br>
> the certificate by decrypting it using the public key in the certificate<br>
> c. make sure the message is not modified by comparing the<br>
> digest value of the assertion and decrypted signature.<br>
<br>
<br>
</div>b and c are both part of what I could call cryptographic operation of<br>
XML Signature verification, they aren't really separate steps, at least<br>
from a high-level. If you were implmenting a low-level XML Signature<br>
library, then yes, these would be separate steps in the process.<br>
<div class="im"><br>
<br>
<br>
<br>
><br>
> I know the method doesn't do step a, but how about step b and c? I<br>
> think the method will do step b, since it accepts signature and<br>
> credential as the parameters. What I really want to know if how step c<br>
> is achieved?<br>
<br>
</div>Both b and c are handled by the OpenSAML SignatureValidator via the<br>
underlying signature library we use (Apache Santuario/xmlsec), so you<br>
don't have to do anything there. If the Signature validates with the<br>
Credential you pass in, then both b and c have been evaluated successfully.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>