sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/19/15 8:35 PM, Brent Putman wrote:
>
> Just for fun, I'll see if I can now get the IdP to sign with ECDSA and
> whether the SP accepts it...  

Doh! Should have quit while I was ahead... so far it doesn't work for
me.  Getting the IdP to sign with ECDSA is easy, but the SP doesn't
accept the signature.  Unless I'm doing something stupid, I think we
have an issue here as well.  SP on debug:

2015-10-19 21:30:33 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [4]:
validating signature profile
2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.ExplicitKey [4]:
attempting to validate signature with the peer's credentials
2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.ExplicitKey [4]: public
key did not validate signature: Digital signature does not validate with
the supplied key.
2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.ExplicitKey [4]: no
peer credentials validated the signature
2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.PKIX [4]: validating
signature using certificate from within the signature
2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.PKIX [4]: Digital
signature does not validate with the supplied key.
2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.PKIX [4]: failed to
verify signature with embedded certificates
2015-10-19 21:30:33 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [4]:
unable to verify message signature with supplied trust engine



If interpret the PKIX engine output correctly, it doesn't even
cryptographically validate successfully with the signature's ds:KeyInfo
data.  So that implies a low-level crypto problem I think.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151019/1545aafe/attachment.html>