sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/19/15 12:37 PM, Brent Putman wrote:
>
> I was going to at least see if I could just reproduce the problem,
> using an SP + new enough OpenSSL for EC support.

I manged to get an SP on a RHEL 6.6 machine with openssl 1.0.1e and do
some basic testing.

In short, I was able to always reproduce Jarno's exact error.  I
couldn't get it to work at all.

I also upgraded to Orace JDK 1.8.0_60, and tried with and without
unlimited strength policy files.

Thinking that it might be an issue with what named curves are supported
in Java, I tried all 3 supported by this version of openssl: secp384r1,
secp521r1, prime256v1.  (I did also discover/relearn that the SunEC
provider only supports named curves, not explicit parameters, for the
keys/certs ).

Also tried both ecdsa-sha1 and ecdsa-sha256 signature algorithms. No luck.

I tried disabling the SunEC provider and installing BC as a security
provider, but I couldn't get my Jetty to work that way.  It horks up
something with the TLS layer in Jetty.  Probably need to tweak something
there, but sort of ran out of time for now.  So wasn't able to determine
yet if BC produces a different result.

So yeah, disappointing, I thought this "just worked".  Definitely
something we need to look at in more depth.  I guess the issue could be
on either end at this point.

I probably will not be able to spend any more time on this for at least
a couple of weeks due to trying to get the release out.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151019/4c2c7cd6/attachment.html>