using cert in SP metadata for encryption

[Tom Scavo]

On Thu, Nov 17, 2016 at 4:18 PM, John Dennis <jdennis at redhat.com> wrote:
>
> In the world of x509 the public key is
> embedded in a certificate and is publicly exchanged. The private key is
> normally just called the "key".
>
> cert == public key
> key == private key
>
> Thus in either case it's the entity performing the encryption or signing
> that needs the (private) key.

Not quite. Encryption requires a public key; decryption requires a private key.

> Private keys are not part of a certificate, a
> certificate contains the public key.
>
> Assuming you've accurately communicated the error then what the error means
> is the IdP cannot encrypt it's response to the SP because the IdP does not
> have an encryption key. The IdP encryption key belongs to the IdP, not the
> SP.

No, the IdP encrypts the response using the SP's public key. The SP
decrypts the response using its private key.

> Essentially you've got things backwards. The entity performing the
> encryption is the entity which needs the key. The entity decrypting is the
> entity which needs the cert (e.g. public key).

No, sorry, you have it backwards, I'm afraid. See the Security and
Network topic: https://wiki.shibboleth.net/confluence/x/VoEOAQ

Tom