SAML Assertion signing and ecryption

[Sam Jacob]

Thanks for the reply Scott,

They did use the key for both signing an encrypting the assertion, but we
are getting an error in the log
---------------------------------------------------------------------------------------------------------------------------
Here's the error from log:
2016-12-08 09:13:12 DEBUG Shibboleth.SSO.SAML2 [1]: processing message
against SAML 2.0 SSO profile
2016-12-08 09:13:12 DEBUG XMLTooling.CredentialCriteria [1]: key algorithm
didn't match ('AES' != 'RSA')
2016-12-08 09:13:12 WARN XMLTooling.Decrypter [1]: XMLSecurity exception
while decrypting key: XSECAlgorithmMapper::mapURIToHandler - URI
http://www.w3.org/2001/04/xmlenc#rsa-1_5 disallowed by whitelist/blacklist
policy
2016-12-08 09:13:12 WARN XMLTooling.Decrypter [1]: unable to decrypt key,
generating random key for defensive purposes
2016-12-08 09:13:12 ERROR Shibboleth.SSO.SAML2 [1]: failed to decrypt
assertion: XMLSecurity exception while decrypting:
OpenSSL:SymmetricKey::decryptFinish - Out of range padding value in final
block
---------------------------------------------------------------------------------------------------------------------------------
in the SAML Response , there' are 2 EncryptionMethods  referenced
<EncryptedAssertion xmlns="urn:oasis:names:tc
:SAML:2.0:assertion"><EncryptedData Type="
http://www.w3.org/2001/04/xmlenc#Element" xmlns="
http://www.w3.org/2001/04/xmlenc#"><EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes256-cbc" /><KeyInfo xmlns="http://www.w
3.org/2000/09/xmldsig#"><EncryptedKey xmlns="
http://www.w3.org/2001/04/xmlenc#"><EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-1_5" /><KeyInfo xmlns="
http://www.w3.org/2000/09/xmldsig#">
---------------------------------------------------------------------------------------------------------------------------------------------

Any clue as to why it resulted in error.?

thanks.

On Thu, Dec 8, 2016 at 11:55 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > 1. can they use the same key for signing and encryption?
>
> Yes. It's common, it's just considered less ideal for key hygiene. Few SPs
> are skilled enough to properly manage even one private key, so adding a
> second doesn't exactly help. Key rollover is also hard, but encryption key
> rolliver is brutally hard, so splitting them has some advantages there.
>
> > 2. we use the metadata generator to generate the metadata file.
>
> You cannot do that. That is always wrong, and it is exactly because of key
> management that it's wrong. You cannot directly expose the keys used by the
> configuration into metadata because that makes key rollover impossible.
> Metadata MUST be curated explicitly, it can only be generated as a one-time
> example to start from.
>
> > changes needs to be made in the application override in shibboleth2.xml,
> so
> > that it generates a separate key for signing and encryption?
>
> You don't need to, nor does this have anything to do with overrides, you
> should never use different keys across overrides, it's one system anyway,
> there's no security advantage to adding more keys.
>
> The metadata generated will be based on whatever CredentialProviders are
> configured and those providers can carry their own use attributes, as
> documented, to split signing and encryption.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Sam Jacob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161208/3fd97983/attachment.html>