SP metadata that supports both sha1 and sha2?

[Liam Hoekenga]

On Wed, Jun 25, 2014 at 2:05 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> What I presumed was that they were also doing some kind of key rollover
> here and/or starting to use SHA-2 at runtime, and any or all of that could
> still be the case. And key rollover would matter a lot of course.
>
> But few vendors do any signing at runtime when they're the SP, so that
> seems unlikely in hindsight. Unless they do support encryption, which would
> be a key rollover concern, but they're not likely to do that as part of
> some kind of SHA-1 retirement plan.
>

Ok.. so both copies of the metadata have different certs in
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>

Both copies of the metadata have unique values in
            <ds:KeyValue>
                <ds:RSAKeyValue>
                    <ds:Modulus>

The certs show up a second time, later in the metadata
    <md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="encryption">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>


My impression is that they're planning on rolling out a new signing cert as
part of their move to sha256.
    ...we still need to know if you were able to get SHA256 support
    working in a way that allows you to have both certs available, so that
there’s
    no outage incurred when we switch the encryption certificate on our
side to
    SHA256...

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140625/6c3cb518/attachment-0001.html