Question about xml-signature algorithm used by Shibboleth IdP

[Brent Putman]

On 8/12/11 11:46 AM, WULMS Alexander wrote:
>
> Hi,
>
>  
>
> I have noticed that by default, Shibboleth 2.3 uses SHA1 algorithm to
> calculate the hash-value for the xml-signature (to build the SAML
> response) and then encrypts the hash with RSA-2048.
>


Right.  Note however that the RSA signature crypto algorithm variant
used is determined directly by your signing key, so if you want a
different size (e.g. 4096) or wanted to use DSA instead, etc, you can
can just change to use a different signing key (credential) in your
config and the signing process will pick that up.



>  
>
> Are the algorithms used to calculate the signature configurable? I
> have not been able to find information about this in the
> documentation. I assume that the encryption algorithm is determined by
> the certificate used but I don't know about the hash algorithm.
>
>  
>

Ask Chad said, it's somewhat low-level and we don't currently expose it
as a config option.  It can be done with a custom Spring bean. If you
really want to change the digest algorithm, and can write a little bit
of Java, see this thread:

http://groups.google.com/group/shibboleth-users/browse_thread/thread/2cea3427ff41b994/689a15b2d072dbcf

That thread was talking about changing a different crypto property for
XML encryption, not signature, but the idea is still the same.  The code
that is pointed to is a little old, you might have to fix up the
dependency versions in the POM, etc, but the Spring bean source should
give you an idea as to what to do.  Just call:

secConfig.registerSignatureAlgorithmURI("RSA",SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1)

replacing the constant with the algorithm ID that you want.

Note that that will be a global change to the IdP, for all relying
parties.  We have discussed possibly having support for configuring this
on a relying-party specific basis in v3.


HTH,
Brent




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110812/1ea62c03/attachment.html