Change digest algorithm to sha256 for EncryptedKey

[Marc Thornton]

Scott,

Our SP and the IDP to which we are connecting are currently required to
XML-encrypt anything sensitive going out over the front channel.  This
includes the Assertion and the NameID, which is why you see our
front-channel logout request with the encrypted NameID.

I believe your previous description of the limited benefits of going beyond
SHA1 in the case of the EncryptedKey will be good enough... I had checked
the XML Encryption spec before following up here to see if SHA256 "mapped",
but I also understand it's not always that easy.

We are able to force the signature & its digest algorithm to sha256 without
any issues, which will hopefully be sufficient.

Thanks again for the assistance.
Marc



On Wed, Apr 18, 2012 at 12:23 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/17/12 1:59 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> >
> >> Is there any way to force this digest algorithm an SHA256 as well?  It
> >>seems to
> >> default to SHA1 regardless of value in digestAlg attribute.
> >
> >No, there is no option for it. I don't recall if the APIs even allow for
> >it on the encrypting end (I know mine don't, but I'm not sure Santuario's
> >do either).
>
> Just FYI, I checked into this, and can confirm that there's no current
> mechanism I could use to set this to something else in Santuario. I don't
> think I can fit in a change of that significance to the 2.5 SP release, so
> I wouldn't expect it.
>
> Note that the SP really doesn't encrypt much of anything. Your example was
> a logout. You could just turn off encryption of the NameID and avoid the
> problem. Particularly in light of the problems with CBC encryption that
> really show no sign of being fixable.
>
> I filed a RFE to track the need for the API change:
> https://issues.apache.org/jira/browse/SANTUARIO-311
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120418/9162b6b6/attachment.html