SP metadata that supports both sha1 and sha2?

[Cantor, Scott]

On 6/25/14, 12:02 PM, "Liam Hoekenga" <liamr at umich.edu> wrote:
>
>Then what's this stuff?

That's the signature over the metadata. That's got nothing to do with what
the party uses to sign messages later. But in terms of the metadata
signature itself, that change is the same as the one InCommon made, to
switch from SHA-1 to SHA-256 on *that* signature.

The only relationship that has to any other functionality is that the
ability to verify a signature over the metadata implies that the same
software will support that algorithm in other contexts.

If all they're trying to do is change the metadata signature itself,
that's pretty much what InCommon has been doing. If the actual content of
the metadata is the same, then you (since you're running Shibboleth as an
IdP) have no issue, all our Java software handles SHA-2 verification. But
I'm not sure if that's all they're trying to change here.

-- Scott