SP metadata that supports both sha1 and sha2?

[Tom Scavo]

On Wed, Jun 25, 2014 at 12:02 PM, Liam Hoekenga <liamr at umich.edu> wrote:
>
> >> Can it contain multiple signature algorithms?
> >
> > It doesn't contain any, not for the signer anyway.
>
> Then what's this stuff?
>
>         <ds:SignedInfo>
>             <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
>             <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
>             <ds:Reference URI="#BWECV5asjkQuYobLAI6P5nzg6Gs">
>                 <ds:Transforms>
>                     <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
>                     <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
>                 </ds:Transforms>
>                 <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
>                 <ds:DigestValue>Vc2rDL5mk1+e+E7TUKiAv7PgJsai6c9u0MQVjkkhkFb=</ds:DigestValue>
>             </ds:Reference>
>         </ds:SignedInfo>

That's why I said I didn't quite understand your question. The above
looks like a partial signature on the metadata itself, which of course
has nothing to do with end entity certificates in metadata.

Tom