Question about xml-signature algorithm used by Shibboleth IdP

[Tom Scavo]

On Fri, Aug 12, 2011 at 11:46 AM, WULMS Alexander
<Alexander.WULMS at swift.com> wrote:
>
> I have noticed that by default, Shibboleth 2.3 uses SHA1 algorithm to
> calculate the hash-value for the xml-signature (to build the SAML response)
> and then encrypts the hash with RSA-2048.
>
> ... I assume that
> the encryption algorithm is determined by the certificate used but I don’t
> know about the hash algorithm.

I don't know about the software, but for reference, InCommon metadata
contains keys with the following sizes:

modulus 4096: 25
modulus 3072: 3
modulus 2048: 903
modulus 1024: 173
modulus 512: 1

I don't have a breakdown by IdP vs SP, however, so I don't know which
are used for signing and which are used for encryption.

Tom

PS. This data was compiled with a script written by Russ Yount @ CMU.