Signing authN requests: yea or nay?

[Nate Klingenstein]

Marlena,

My opinion is that there is no security protection to be gained by requiring signed AuthnRequests and several drawbacks associated with it.  Tinkering with anything in the AuthnRequest will generally either have no practical effect or cause the IdP to refuse to issue an assertion entirely.  The IdP will also refuse to send assertions intended for endpoints that are not valid for an SP, along with the encryption that you mention.

The major exception to that is forceAuthn and there are a variety of checks the SP can perform when the user gets back to make sure that forceAuthn was honored.  The Shibboleth SP makes these checks.

Exposing an endpoint that issues signed AuthnRequests can also make you a target for DDoS attacks because of the highly asymmetric nature of the exchange(one unauthenticated, replayable request from the attacker -> expensive server-side crypto operation at the SP).

Finally, if an attacker already has control of a user(has them at their site, willing to login) then they can just as easily spoof up the IdP pages and the rest of the flow if they're trying to get the user to reveal some information to them.

Hope this helps,
Nate.

On Sep 23, 2013, at 22:51 , Erdos, Marlena wrote:

> 
> Apologies -- I know this topic of whether or not to sign authN requests
> has come up before, but my attempts at searching haven't yielded enough
> material for us to make a determination**.
> 
> Our inclination (as a soon to be live IdP) is to require signed authN
> requests. 
> 
> Sure, we could encrypt the response  and let that serve as a guard against
> unwarranted parties reading the assertion but I'm kind of against
> solutions that are open to off-line attack even if one could say "who
> would bother?"
> 
> Thoughts?
> 
> Thanks,
> Marlena
> **For example, Windows Azure won't accept signed authN requests (though
> that site doesn't say why that I noticed); on the other hand  a note from
> Scott Cantor from some years back which I found on a Terena site says that
> signing can have technical advantages (with some specifics).
> 
> 
> 
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>