SP metadata that supports both sha1 and sha2?

[Liam Hoekenga]

Maybe it would help if I rephrased things.

We have two pieces of SP metadata for Gartner - both using the same
entityID, and the same endpoint URLs.
One metadata file is signed using sha1, and includes certificate A.
The other metadata file is signed using sha256, and includes certificate B.

Is it possible / correct / valid to combine both pieces of metadata into a
single EntityDescriptor entry that contains both that sha1 and sha256
signatures (and the certs used to generate them)?

Liam


On Wed, Jun 25, 2014 at 12:13 PM, Tom Scavo <trscavo at gmail.com> wrote:

> On Wed, Jun 25, 2014 at 12:02 PM, Liam Hoekenga <liamr at umich.edu> wrote:
> >
> > >> Can it contain multiple signature algorithms?
> > >
> > > It doesn't contain any, not for the signer anyway.
> >
> > Then what's this stuff?
> >
> >         <ds:SignedInfo>
> >             <ds:CanonicalizationMethod Algorithm="
> http://www.w3.org/2001/10/xml-exc-c14n#"/>
> >             <ds:SignatureMethod Algorithm="
> http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
> >             <ds:Reference URI="#BWECV5asjkQuYobLAI6P5nzg6Gs">
> >                 <ds:Transforms>
> >                     <ds:Transform Algorithm="
> http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
> >                     <ds:Transform Algorithm="
> http://www.w3.org/2001/10/xml-exc-c14n#"/>
> >                 </ds:Transforms>
> >                 <ds:DigestMethod Algorithm="
> http://www.w3.org/2001/04/xmlenc#sha256"/>
> >
> <ds:DigestValue>Vc2rDL5mk1+e+E7TUKiAv7PgJsai6c9u0MQVjkkhkFb=</ds:DigestValue>
> >             </ds:Reference>
> >         </ds:SignedInfo>
>
> That's why I said I didn't quite understand your question. The above
> looks like a partial signature on the metadata itself, which of course
> has nothing to do with end entity certificates in metadata.
>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140625/81c04def/attachment-0001.html