sha256 hashing

[Clayton]

I don't think we need to do anything with our certificates for this move.

I think InCommon is taking down it's Fallback metadata, which is signed
with SHA1 and the only remaining options are signed with SHA256.  You can
see this signature and the algorithm right in the XML:

Fallback:
	ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"

Production: 
	ds:SignatureMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"


I'll bet your vendor is confused because those metadata docs include lots
of certificates.  As far as I know, there are no new requirements on those
internal certificates (aka: our certificates).  

For example, look in the Production metadata feed.  The very first
entity's certificate is one of Ohio State's (I think for their CarmenWiki
if I'm reading it right).  Their certificate's right there and if you
decode it you can see that it's signed with SHA-1, even though the XML doc
that contains it is signed with SHA-256.

--Clayton

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140530/d5fecd55/attachment.html