Replace sha1 by sha256

[MOTTE Frederic]

OK thank you.

So, if I want to change the algorithm for the signature and the encryption, I must just change the code of the IdP or I must realize some modification into the SP too? It's possible without big modification?

[@@THALES GROUP RESTRICTED@@]


-----Message d'origine-----
De : users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] De la part de Cantor, Scott
Envoyé : mardi 29 mai 2012 15:39
À : Shib Users
Objet : Re: Replace sha1 by sha256

On 5/29/12 8:04 AM, "MOTTE Frederic" <frederic.motte at thalesgroup.com>
wrote:
>
>I need to replace the algorithm for the encryption and the signature of
>the assertion (SHA1 (default mode) to SHA256).

V2 doesn't support that, unless you want to make low level source changes.

> 
>I find some information on the wiki
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRelyingParty
>but an not sure about the impact.

That has nothing to do with the IdP's signing operations.

>If I replace signingAlg with RSA-SHA256, digestAlg with SHA256 and
>encryptionAlg with RSA-SHA256 on the SP relyingParty, the IdP will signed
>and encrypted the assertion with the new algorithm, right?

No.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net