Questions about signing key pair in IdP

[Cantor, Scott]

On 7/10/12 11:30 AM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>I think this needs further clarification. Suppose you have a key
>descriptor with use="signing" in the IDPSSODescriptor element and
>another key descriptor with use="signing" in the
>AttributeAuthorityDescriptor element. If the two certificates are the
>same, then the same key pair is used for everything:

Yes, that's true.

>If, OTOH, the two certificates are different, then key pair #2 is used
>for:
>
>- message signing in conjunction with attribute query (if the IdP
>supports that)
>- SSL/TLS in conjunction with artifact query

No, in that case, it will fail, because artifact flows use the IDP role.

>while key pair #1 is used for everything else, including message
>signing on the front channel, message signing in conjunction with the
>artifact binding, and SSL/TLS in conjunction with the artifact
>binding.

Yes. You mentioned artifact twice there in both cases.

>That said, I've never seen two different use="signing" certificates in
>IdP metadata, which is not surprising since such a deployment would be
>very complicated.

I wouldn't say very, but with all the trouble people have, we just haven't
felt it's worth it.

> Likewise, I've never seen a use="encryption"
>certificate in IdP metadata since I don't believe there's anything an
>SP could send an IdP that could be encrypted. Oh, I take that back, an
>SP could send an encrypted NameID in the AuthnRequest...not sure if
>there's any software that supports this edge case, however.

The usual case is in a LogoutRequest. Which the SP supports, but the IdP
does not.

-- Scott