Shibboleth and SHA-256 ?

[Cantor, Scott]

CC'ing the list. Such questions should go to the list for public archival.

> Ann and I got the following question from one of the members of the AD
> Assurance group, asking if Shibboleth supports SHA-256 for signing
> assertions. He's found some two-year old information, saying that Shib
> doesn't support SHA-256, as well as a decision last February to make it the
> default.

Algorithms in the IdP are only configurable at a low level, so changing to SHA-256 is a global setting that will break interop with any implementation that can't handle it. It has always been possible to do it, at least as far back as any release we've done in recent memory. As far as I'm aware, all versions of the IdP support verifying signatures with SHA-256 in them, such as for metadata.

> My guess is this means that SHA-256 has been possible for a while, and that it
> may be the default now. Can you give us an authoritative answer?

It has essentially never not been possible. It will probably break systems. How many is anybody's guess. It is not the default, and won't be until 3.0. I can't say for certainty it will be the default there because nobody knows the impact of that decision at this time, but I think it's highly likely.

The most prevalent system known to lack support for SHA-2 is anything using OpenSSL on Red Hat 4. While RH4 is not supported by the Shibboleth Project any longer, because it's past the official vendor EOL, it remains in extended support by Red Hat. 

Ian has done a lot more investigating and planning for this than I have, and I believe the UK Federation has a tentative date at least for moving to SHA-256 signed metadata.

-- Scott