Change digest algorithm to sha256 for EncryptedKey

[Cantor, Scott]

On 4/17/12 1:59 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>> Is there any way to force this digest algorithm an SHA256 as well?  It
>>seems to
>> default to SHA1 regardless of value in digestAlg attribute.
>
>No, there is no option for it. I don't recall if the APIs even allow for
>it on the encrypting end (I know mine don't, but I'm not sure Santuario's
>do either).

Just FYI, I checked into this, and can confirm that there's no current
mechanism I could use to set this to something else in Santuario. I don't
think I can fit in a change of that significance to the 2.5 SP release, so
I wouldn't expect it.

Note that the SP really doesn't encrypt much of anything. Your example was
a logout. You could just turn off encryption of the NameID and avoid the
problem. Particularly in light of the problems with CBC encryption that
really show no sign of being fixable.

I filed a RFE to track the need for the API change:
https://issues.apache.org/jira/browse/SANTUARIO-311

-- Scott