sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Jarno Huuskonen]

On Tue, Oct 20, Brent Putman wrote:
> 
> 
> On 10/20/15 12:44 PM, Cantor, Scott wrote:
> >
> > Hmm. Hopefully Brent just tweaked something and a POST from the IdP actually does work. Otherwise this is getting pretty weird.
> 
> The obvious mistake - wrong key in metadata - doesn't seem to be the
> case.  So I don't know, it is pretty weird.
> 
> Most interesting is that the SP can validate a metadata signature from
> the Java xmlsectool.  The big delta there is xmlsectool is still using
> Santuario 1.5.7, as where OpenSAML/IdP 3.x are using Santuario 2.0.3. 
> So therein may lie the difference.

SP can validate xmlsectool.sh (ecdsa) signed metadata if I manually
remove empty KeyValue from the metadata(signature):
...
<ds:SignatureValue>sigvalhere...
</ds:SignatureValue>
<ds:KeyInfo>
<ds:KeyValue>  <!-- remove this line -->
</ds:KeyValue> <!-- remove this line -->
<ds:X509Data>
...

I changed idp to use ecdsa cert -> SP fails to validate ecdsa signed
saml2p:Response. (Also xmlsectool.sh and xmlsec1 fail to validate this
ecdsa signed response:
# xmlsectool.sh --verifySignature  --signatureRequired --certificate \
server.pem --inFile resp-ecdsa.xml
WARN  XMLSignature - Signature verification failed.
ERROR XmlSecTool - XML document signature verification failed

# xmlsec1 --verify --trusted server.pem --id-attr:ID Response \
resp-ecdsa.xml
func=xmlSecOpenSSLEvpSignatureVerify:file=signatures.c:line=492:obj=ecdsa-sha256:subj=EVP_VerifyFinal:error=18:data
do not match:signature do not match
FAIL
)

To summarize what works:
- SP can verify ecdsa signed metadata
- SP can send ecdsa signed request to IDP (Post binding)

and doesn't work:
- IDP fails when SP sends ecdsa signed request to Redirect binding
- SP fails to verify ecdsa response from IDP

-Jarno

-- 
Jarno Huuskonen