Veoci Integration

[Brent Putman]

On 2/8/17 4:45 PM, Cantor, Scott wrote:
> On 2/8/17, 4:33 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:
>
> You can't encrypt with a DSA key in any way we support, so that is the issue.

Indeed. DSA is not supported for (direct) encryption period, XML or
otherwise. (I'm not counting indirect use e.g. in TLS for
authenticating key exchange and then ephemeral DH).

Static/fixed Diffie-Hellman is mathematically akin to DSA (the discrete
log problem).  And fun fact: you can actually have a cert with fixed DH
key info. But I've never seen one and I think many TLS libs like
openssl don't even support that mode, even though it's defined in the
SSL/TLS spec.


>  Possibly logging for that needs to improve (though maybe it shows up if you logged the category Brent named), though encountering something once every 5 years doesn't exactly scream high priority.

Looking again at Nate's log, I think he only has DEBUG on for the IdP. 
Had he had it (or TRACE) on for opensaml, or at least those 2 packages
I mentioned, he would have gotten some hints from at least the SAML
params resolver, like:

For every candidate key transport cred:

log.trace("Evaluating key transport encryption credential from SAML
metadata of type: {}", key != null ? key.getAlgorithm() : "n/a");

When it failed to resolve any supported algorithm for that candidate cred:

log.debug("Unable to resolve key transport algorithm for credential
with key type '{}', " + "considering other credentials",


In some of of the lower level code on at least TRACE, there's also
logging of the cred's key's algorithm type.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170208/0992c3fe/attachment.html>