sp(2.5.5) <-> idp(3.1.2) and ecdsa certs

[Brent Putman]

On 10/21/15 12:46 PM, Cantor, Scott wrote:
>
> That could also be the problem. The Redirect binding may not be following quite the same rules for padding and such.

The would line up with the originally reported error with the redirect,
which sounds like a data encoding/representation issue:

Caused by: java.io.IOException: Sequence tag error
        at sun.security.util.DerInputStream.getSequence(DerInputStream.java:297)


I guess there's something that's ASN.1 here?  Not clear to me what that
would be, other than the PublicKey.  Is there ASN.1 in the actual
signature bytes? The cert/publicKey is not even sent by the SP in this
binding, it's coming from metadata.  And if there were an issue there,
I'd think it would fail when it parses the KeyInfo data into the
PublicKey, not a verify time. 


> I don't even recall what the SAML spec says about that.


I took a quick look and SAML 2 Bindings doesn't really seem to say
anything about the particulars of the crypto padding or other details. 
Just covers the construction of the string to be signed.  Since RSA
works, I wouldn't think the issue would be there.  But who knows... 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151021/868a8bf5/attachment-0001.html>