sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Jarno Huuskonen]

On Tue, Oct 20, Brent Putman wrote:
> >> I tested that SP can verify ecdsa signed metadata, so ecdsa signed
> >> response probably works.
> > Apparently not. What was the metadata signed with?
> 
> Yeah, I had the same question.  What toolset, library, etc was used? 
> If it's something Java-based, then that's hopeful, and maybe I just
> screwed something up in my IdP->SP test.

Metadata was signed with xmlsec1+openssl (https://www.aleksey.com/xmlsec/):
(used version that comes with rhel7/centos7):
xmlsec1 --sign --privkey-pem private-key.pem,server.pem --id-attr:ID \
EntitiesDescriptor --output signed.xml unsigned.xml

(for metadata signing used key/cert: secp384r1 and
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>)

I can also sign the same metadata with xmlsectool.sh (key/cert in
keystore):
xmlsectool.sh --sign --inFile unsigned.xml \
--referenceIdAttributeName ID \
--digest sha-384 --keystore keystore.jks --keyPassword changeit \
--keystoreType jks --key uef_metadata --outFile signed.xml

And I can verify both xmlsectool.sh and xmlsec1 signed metadata with:
xmlsec1 and xmlsectool.sh
(xmlsec1 --verify --trusted server.pem --id-attr:ID EntityDescriptor signed.xml
xmlsectool.sh --verifySignature  --signatureRequired --certificate \
server.pem --inFile signed.xml)

(The only difference (apart from signature/digest values) between
xmlsec1 / xmlsectool.sh signature is that xmlsectool.sh adds empty:
<ds:KeyValue>
</ds:KeyValue>). But I can do some more testing tomorrow so I didn't miss
something obvious with ecdsa metadata signatures.
(at least validation failed(xmlsec1,xmlsectool.sh,SP) if I modify something
in the metadata).

-Jarno

-- 
Jarno Huuskonen