sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Jarno Huuskonen]

Hi,

On Wed, Oct 21, Cantor, Scott wrote:
> On 10/21/15, 1:06 PM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:
> 
> >Caused by: java.io.IOException: Sequence tag error
> >        at sun.security.util.DerInputStream.getSequence(DerInputStream.java:297)
> >I guess there's something that's ASN.1 here?  Not clear to me what that would be, other than the PublicKey.  Is there ASN.1 in the actual signature bytes? The cert/publicKey is not even sent by the SP in this binding, it's coming from metadata.  And if there
> > were an issue there, I'd think it would fail when it parses the KeyInfo data into the PublicKey, not a verify time.
> 
> Yeah, that's interesting.
> 
> >I took a quick look and SAML 2 Bindings doesn't really seem to say anything about the particulars of the crypto padding or other details.  Just covers the construction of the string to be signed.  Since RSA works, I wouldn't think the issue would be there.
> > But who knows...  
> 
> Well, from having fixed the ECDSA code last year, the problem was that I didn't read all the detailed rules for how the padding works and how to combine the R and S values to make up the final signature, none of which OpenSSL does for you. And XML Signature says either directly or by reference how that's done to produce the octets you base64-encode into the SignatureValue element.

I did some more testing and I think I know why ECDSA signed AuthnRequest
from SP to IdP(Redirect binding) doesn't work:
- SP (xml-security-c: OpenSSLCryptoKeyEC::signBase64SignatureDSA) creates
the signature as "bare": BN_bn2bin(dsa_sig->r)BN_bn2bin(dsa_sig->s)
- IdP (java jce ecdsa) expects the ECDSA signature to be:
  asn.1 SEQUENCE { r : INTEGER,
  s : INTEGER }

(If I manually create (with script/openssl) ecdsa signed AuthnRequest
where the signature is asn.1 sequence and send this request to
IdP(redirect) then IdP will accept the request).

(from xmlsec-2.0.5 SignatureECDSA.java it looks like:
- The JAVA JCE ECDSA Signature algorithm creates ASN.1 encoded (r,s)
- the XML Signature requires the core BigInteger values.).

So maybe java-opensaml (org.opensaml.security.crypto.SigningUtil) should
wrap the bare signature with ASN.1 sequence (convertXMLDSIGtoASN1) before
trying to verify the signature.

-Jarno

-- 
Jarno Huuskonen