dual signing keys (Was: Support for signing key on hardware security modules)

[Tom Scavo]

On Wed, Dec 20, 2017 at 7:51 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 12/20/17, 7:44 PM, "users on behalf of Oluf Færø" <users-bounces at shibboleth.net on behalf of ofa at klintra.fo> wrote:
>
>> What is required to integrate the IDP awith a hardware security module (HSM) for signing of assertions etc. ?
>
> I've been asked to investigate it a bit for OSU, but I'm not confident there will be any performant and scalable solution that isn't too expensive and hard to deploy.
>
> My strategy is probably going to be to start using different signing keys for high-risk services that need frequent key rotation and a long lived key for other services. Of course, what OSU thinks is high risk is not the same thing as what an SP might think is high risk. I'm perfectly fine dividing the world into "handles key roll over" and "not", and rolling my key often for the former group.

I forgot to ask the ultimate question (which is more interesting than
the service categorization issue you mentioned): How will you
distribute the signing certificate for the short-lived key?

I guess the answer depends on what you mean by "short-lived." If by
that you mean O(days), I don't think current infrastructure is
adequate.

Tom