sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/19/15 12:25 PM, Cantor, Scott wrote:
>
> Yes, but since he managed to generate a signature with that algorithm, I'm sure it's fine. 

I was thinking of some very low-level bug in the actual signature
crypto impl such that Java can't validate it.  Such that one of them is
broken (not making any claims as to which).


> Most anything recent now actually does have EC.

All of my current test environments are RHEL 5.x, which doesn't support
(b/c OpenSSL 0.9.8).  Think I can get a RHEL 6.x. or 7.x.


> I've only tested the low-level crypto against the interop test vectors, nothing in SAML space.
>

Ok.  But technically there's no "SAML" here, since it's the Redirect
binding signature, not XML signature. I mean, it's just a raw
signature, aside from the details of binding encoding.


> I personally wouldn't be wasting much time on it at the SP end, I'd see if the IdP can generate the signatures and if the SP can read them before spending much time on anything else.

That would be a useful test, but might be difficult/impossible to get
the IdP to issue a Redirect binding back to the SP on SSO.

I was going to at least see if I could just reproduce the problem,
using an SP + new enough OpenSSL for EC support.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151019/c3cf89f4/attachment-0001.html>