<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
On 8/12/11 11:46 AM, WULMS Alexander wrote:
<blockquote
cite="mid:1759DECB91276E4083D703A908840BE70144065D9007@BE-EXCHANGE-10.swift.corp"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 12 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have noticed that by default, Shibboleth
2.3 uses SHA1 algorithm to calculate the hash-value for the
xml-signature (to build the SAML response) and then encrypts
the hash with RSA-2048. </p>
</div>
</blockquote>
<br>
<br>
Right. Note however that the RSA signature crypto algorithm variant
used is determined directly by your signing key, so if you want a
different size (e.g. 4096) or wanted to use DSA instead, etc, you
can can just change to use a different signing key (credential) in
your config and the signing process will pick that up.<br>
<br>
<br>
<br>
<blockquote
cite="mid:1759DECB91276E4083D703A908840BE70144065D9007@BE-EXCHANGE-10.swift.corp"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Are the algorithms used to calculate the
signature configurable? I have not been able to find
information about this in the documentation. I assume that the
encryption algorithm is determined by the certificate used but
I don’t know about the hash algorithm.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
<br>
Ask Chad said, it's somewhat low-level and we don't currently expose
it as a config option. It can be done with a custom Spring bean. If
you really want to change the digest algorithm, and can write a
little bit of Java, see this thread:<br>
<br>
<a class="moz-txt-link-freetext" href="http://groups.google.com/group/shibboleth-users/browse_thread/thread/2cea3427ff41b994/689a15b2d072dbcf">http://groups.google.com/group/shibboleth-users/browse_thread/thread/2cea3427ff41b994/689a15b2d072dbcf</a><br>
<br>
That thread was talking about changing a different crypto property
for XML encryption, not signature, but the idea is still the same.
The code that is pointed to is a little old, you might have to fix
up the dependency versions in the POM, etc, but the Spring bean
source should give you an idea as to what to do. Just call:<br>
<br>
secC<span class="pygments-n">onfig</span><span class="pygments-o">.</span><span
class="pygments-na">registerSignatureAlgorithmURI</span><span
class="pygments-o">(</span><span class="pygments-s">"RSA"</span><span
class="pygments-o">,</span><span class="pygments-"> </span><span
class="pygments-n">SignatureConstants</span><span
class="pygments-o">.</span><span class="pygments-na">ALGO_ID_SIGNATURE_RSA_SHA1</span><span
class="pygments-o">)<br>
<br>
replacing the constant with the algorithm ID that you want.<br>
<br>
Note that that will be a global change to the IdP, for all relying
parties. We have discussed possibly having support for
configuring this on a relying-party specific basis in v3.<br>
<br>
<br>
HTH,<br>
Brent<br>
<br>
<br>
</span><br>
<br>
</body>
</html>