sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Cantor, Scott]

On 10/19/15, 12:21 PM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:


>
>See below, but I think the relevant info for the SP is probably going to be what version of OpenSSL is in use here on the SP.  And if it's supplied by the OS (RPM, etc) then what OS platform/version.

Yes, but since he managed to generate a signature with that algorithm, I'm sure it's fine. Most anything recent now actually does have EC.

>The ERROR message logged is from the actual signature verification operation.  So my guess would be that this is at the low level of the crypto itself.  So if there's an interop issue, I think it's likely to be something between the signature generated by OpenSSL
> at the SP and the signature validation at the Java JCA layer at the IdP.   Or possibly with the query param encoding/decoding for the Redirec binging - but we know RSA works there, so I can't imagine why EC would be different.

I've only tested the low-level crypto against the interop test vectors, nothing in SAML space.

I personally wouldn't be wasting much time on it at the SP end, I'd see if the IdP can generate the signatures and if the SP can read them before spending much time on anything else.

-- Scott