sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Jarno Huuskonen]

Hi,

Out of curiosity I created a (self-signed) ecdsa cert
(Signature Algorithm: ecdsa-with-SHA256
Public Key Algorithm: id-ecPublicKey
ASN1 OID: prime256v1)

and tried to use this cert/key in metadata between sp2.5.5 and idp3.1.2.
(idp has oracle jdk 1.8.0_51 (with unlimited jce)).

I modified SP(ApplicationDefaults) to use:
signingAlg="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"

(without this sp throws xmltools/xmlsec error). With SAML Tracer it
looks like that sp sends AuthnRequest with ecdsa-sha256
(BTW are there any tools to verify AuthnRequest signature?).

But idp fails with:
2015-10-16 14:41:37,355 - DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:354] - Found no cached credentials in KeyDescriptor object metadata, resolving from KeyInfo
2015-10-16 14:41:37,376 - ERROR [org.opensaml.security.crypto.SigningUtil:219] - Error during signature verification
java.security.SignatureException: Could not verify signature
        at sun.security.ec.ECDSASignature.engineVerify(ECDSASignature.java:320)
Caused by: java.security.SignatureException: Could not decode signature
        at sun.security.ec.ECDSASignature.decodeSignature(ECDSASignature.java:386)
Caused by: java.io.IOException: Sequence tag error
        at sun.security.util.DerInputStream.getSequence(DerInputStream.java:297)


So it looks like idp doesn't find correct cert from metadata.
Do I need additional config in sp or idp or some extra info in metadata ?
(and are ecdsa certs "supported").

The example metadata file had the ecdsa cert configured like this:
<EntityDescriptor entityID="https://entityid...">
  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
    <KeyDescriptor>
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
       <ds:X509Data>
          <ds:X509Certificate>base64cert...</ds:X509Certificate>
        </ds:X509Data>
     </ds:KeyInfo>
    </KeyDescriptor>
...
</EntityDescriptor>

-Jarno

-- 
Jarno Huuskonen