Shibboleth Identity Provider and OpenSAML-J Security Advisory - [25 February 2015]

[Keith Wessel]

Thanks, Scott. So, any cert directly signed by the keyauthority cert? Or
does this go as far as any cert with a chain that leads to the
keyauthority cert?

Keith

On Thu, Feb 26, 2015 at 11:25:44PM +0000, Cantor, Scott wrote:
> On 2/26/15, 6:20 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
> 
> >Thanks for the very detailed write-up of this, Brent.
> >
> >A question: if the certificate in the keyauthority block of metadata 
> >isn't actually used to sign any of the entities' certificates, is there 
> >still a problem?
> 
> Yep.
> 
> > All of our SPs are instructed to use long-lived self-signed 
> >certificates, and we verify that they are using such certificates before 
> >we approve them. Our regional federation metadata still contains a 
> >keyauthority block, but the cert in that block has nothing to do with any 
> >of those self-signed certs, obviously.
> 
> Doesn't matter, the bug turns anything signed by that CA into a valid key 
> for anything it applies to.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Keith Wessel
CITES Directory Service Manager
University of Illinois at Urbana-Champaign
Phone: (217) 265-0313
kwessel at illinois.edu

"Be nice to nerds.  Chances are you'll end up working for one." -Charles Sykes