Heartbleed security implications for Service Providers

[Cantor, Scott]

On 4/9/14, 4:34 PM, "Aaron Scruggs" <ascruggs at academicworks.com> wrote:
>
>Do I need to recompile shibd against a new version of openssl or is
>simply upgrading openssl on the server good enough?

In practice, static linking pretty much anywhere in the stack of C++ code
will simply crash, so it's extremely unlikely that you're not dynamically
linked. A simple ldd or equivalent will tell you though.

>Do I need to rekey any certs?  Some that come to mind are my Signature
>cert and my CredentialResolver key & cert.

Those are the same thing.

Essentially, unless you know for a fact that all of the IdP endpoints and
metadata endpoints the SP has ever contacted while vulnerable are
themselves not vulnerable, the conservative assumption is that the SAML
key is compromised.

For example, the non-federated SPs at OSU have only ever contacted my IdP,
my metadata host, and InCommon's metadata host. None of those were
affected, so I can conclude that the affected SPs are likely safe.

Once you add federation in the mix, you basically lose much pretense of
being safe unless you go ask every IdP.

None of this has any connection to your TLS. Only you know whether your
web server is affected and by extension your server key, which has nothing
whatsoever to do with the SP.

-- Scott