Signing SAML assertions with ECDSA algorithm in the IdP

[Matan Hamilis]

Hi everyone,
I've noticed it should theoretically be possible to sign the SAML assertion
with the ECDSA algorithm. (
https://wiki.shibboleth.net/confluence/display/IDP4/SecurityConfiguration).
According to the documentation it mentions that the picking either ECDSA or
RSA should be done based on the key size.
However, I've tried using multiple key sizes and failed to generate an
ECDSA key. (I've specified the key size using the -Didp.keysize in the
installer).
I've decided to try to read the code of the installer and got to the
following code (from V4Install.java):

              final SelfSignedCertificateGenerator generator = new
SelfSignedCertificateGenerator();
              generator.setCertificateFile(crt.toFile());
              generator.setPrivateKeyFile(key.toFile());
              generator.setKeySize(installerProps.getKeySize());
              generator.setHostName(installerProps.getHostName());

generator.setURISubjectAltNames(Collections.singletonList(installerProps.getSubjectAltName()));
              log.info("Creating {}, CN = {} URI = {}, keySize={}",
fileBase,
                      installerProps.getHostName(),
installerProps.getSubjectAltName(), installerProps.getKeySize());
              try {
                generator.generate();
                } catch (final Exception e) {
                    log.error("Error building {} files", fileBase, e);
                    throw new BuildException("Error Building Self Signed
Cert", e);
                }

In which the generator object generates key with the given characteristics
to the determined output files.
The generator is initialized in the SelfsignedCertificateGenerator() with
attribute "keyType" which defauls to "RSA".
I couldn't find any way to control the key to be of another type (such as
elliptic curve).
Does anyone know how to do this?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210525/4c1df3e8/attachment.htm>