Shibboleth 2.5.1 blacklist of RSA 1.5

[Cantor, Scott]

On 1/29/13 12:10 PM, "praveen" <praveen.pinto at peopleadmin.com> wrote:
>
>Thanks for replying to my post..  The only response I get in my logs after
>setting IncludeDefaultBlacklist to false is it continues to blacklist rsa
>1.5.  Anywhere else I can look, or force it to bypass that?

I tested the setting, and it worked fine at the time. I have no time right
now to go do more checking on that. You can file a bug, but basically I
won't be looking at it for a while. So, I suggest you debug into it if you
care strongly enough about it.

In particular even if there were a bug, there won't be a patch any time
soon, so you'd be forced to patch it yourself anyway.

You should be thinking long and hard about doing this. Using 1.5
essentially exposes your private key to an attacker. It's a completely
broken algorithm at this point. In particular, do NOT use it unless you
create a separate keypair for signing (or are not doing any signing with
that key).

>security-policy.xml IncludeDefaultBlacklist setting doesn't seem to take,
>and I have verified both the /etc/shibboleth and /var/run/shibboleth
>copies
>have that set to false..

I don't know what you're referring to, there is no copy in /var/run.

>I even tried explicitly setting rsa1.5 to
>whitelist, but I guess blacklist trumps whitelist?

Yes, but if you have a whitelist and no blacklist, then it would work. So
I would say that suggests you are editing the wrong file and that you're
not using the settings you think you are. That would be a more logical
explanation for the flag not working anyway.

-- Scott