SP metadata: certificate for signing and encryption

[Alexey]

The specification says that:

Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0
<http://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf>  

*2.4.1.1 Element <KeyDescriptor>*

The *<KeyDescriptor>* element provides information about the cryptographic
key(s) that an entity uses to sign data or receive encrypted keys, along
with additional cryptographic details. Its *KeyDescriptorType* complex type
consists of the following elements and attributes:

*use* [Optional]
   Optional attribute specifying the purpose of the key being described.
Values are drawn from the
   KeyTypes enumeration, and consist of the values *encryption* and
*signing*.
   
*<ds:KeyInfo>* [Required]
   Optional element that directly or indirectly identifies a key.

As far as I know, for the sending of secure data in both directions, I
should have: 

1. My own private key
2. My own public key
3. Recipient's public key

Certificate of what key I should specifying in the SP- metadata and сan I
use the same certificate for signing and encryption? Part of the SP-
metadata file:


> ...
> <md:KeyDescriptor use="signing">
> 	
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> 		
> <ds:X509Data>
> 			
> <ds:X509Certificate>
> 				MIID...ZiQ==
> 			
> </ds:X509Certificate>
> 		
> </ds:X509Data>
> 	
> </ds:KeyInfo>
> </md:KeyDescriptor>
> <md:KeyDescriptor use="encryption">
> 	
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> 		
> <ds:X509Data>
> 			
> <ds:X509Certificate>
> 				MIID...ZiQ==
> 			
> </ds:X509Certificate>
> 		
> </ds:X509Data>
> 	
> </ds:KeyInfo>
> </md:KeyDescriptor>
> ...

I would be very grateful for the information. Thanks to all.



-----
Kind regards, Alexey
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SP-metadata-certificate-for-signing-and-encryption-tp7603709.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.