Change digest algorithm to sha256 for EncryptedKey

[Marc Thornton]

We have a requirement to use SHA256-based algorithms for SAML 2 signature
and digest for communicating with an external IDP (possibly Shibboleth, but
not positive).

I have been able to switch the signing algorithm very easily using the
shibboleth2.xml signingAlg on the ApplicationDefault, ApplicationOverride
and RelyingParty nodes.  I've also been able to confirm that setting the
shibboleth2.xml digestAlg will properly set the digest algorithm within a
signature.

Where I am struggling is that a digest algorithm of SHA1 is consistently
being used for the EncryptedKey within the EncryptedAssertion, EncryptedID,
despite the digestAlg setting within the shibboleth2.xml

Is there any way to force this digest algorithm an SHA256 as well?  It
seems to default to SHA1 regardless of value in digestAlg attribute.

Using Shibboleth SP 2.4.3 on Linux RHEL 5, 64-bit, OpenSaml 2.4.3, XML
Tooling 1.4.2.

An example below:

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                     Destination="https://idp.example.com/SAML2/Redirect/SLO
"
                     ID="_4fecc1e19c77c2beed48212b3f721968"
                     IssueInstant="2012-04-17T16:47:08Z"
                     Version="2.0">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://sp.example.com/Shibboleth</saml:Issuer>
    <saml:EncryptedID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element">
            <xenc:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes128-cbc" />
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <xenc:EncryptedKey xmlns:xenc="
http://www.w3.org/2001/04/xmlenc#">
                    <xenc:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
                        <ds:DigestMethod Algorithm="
http://www.w3.org/2000/09/xmldsig#sha1"
                                         xmlns:ds="
http://www.w3.org/2000/09/xmldsig#"/>
                    </xenc:EncryptionMethod>
                    <xenc:CipherData>
                        <xenc:CipherValue>.....</xenc:CipherValue>
                    </xenc:CipherData>
                </xenc:EncryptedKey>
            </ds:KeyInfo>
            <xenc:CipherData>
                <xenc:CipherValue>... ...</xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>
    </saml:EncryptedID>

<samlp:SessionIndex>8ebfb37e2afededc003df1cf741b7fc21cea1099c79280bad2dd264b6e651d25</samlp:SessionIndex>
</samlp:LogoutRequest>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120417/b88cbd61/attachment.html