<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.pygments-n
{mso-style-name:pygments-n;}
span.pygments-o
{mso-style-name:pygments-o;}
span.pygments-na
{mso-style-name:pygments-na;}
span.pygments-s
{mso-style-name:pygments-s;}
span.pygments-
{mso-style-name:pygments-;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thanks for the extended reply. It answers my question. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I really appreciate your idea of being able to configure the signing algorithm on a relying-party specific basis in v3. It would allow to use the strongest signing algorithm supported by an SP.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Kind regards,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Alex<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>Brent Putman<br><b>Sent:</b> Friday, August 12, 2011 9:40 PM<br><b>To:</b> users@shibboleth.net<br><b>Subject:</b> Re: Question about xml-signature algorithm used by Shibboleth IdP<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><br><br>On 8/12/11 11:46 AM, WULMS Alexander wrote: <o:p></o:p></p><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I have noticed that by default, Shibboleth 2.3 uses SHA1 algorithm to calculate the hash-value for the xml-signature (to build the SAML response) and then encrypts the hash with RSA-2048. <o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br>Right. Note however that the RSA signature crypto algorithm variant used is determined directly by your signing key, so if you want a different size (e.g. 4096) or wanted to use DSA instead, etc, you can can just change to use a different signing key (credential) in your config and the signing process will pick that up.<br><br><br><br><br><o:p></o:p></span></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Are the algorithms used to calculate the signature configurable? I have not been able to find information about this in the documentation. I assume that the encryption algorithm is determined by the certificate used but I don’t know about the hash algorithm.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br>Ask Chad said, it's somewhat low-level and we don't currently expose it as a config option. It can be done with a custom Spring bean. If you really want to change the digest algorithm, and can write a little bit of Java, see this thread:<br><br><a href="http://groups.google.com/group/shibboleth-users/browse_thread/thread/2cea3427ff41b994/689a15b2d072dbcf">http://groups.google.com/group/shibboleth-users/browse_thread/thread/2cea3427ff41b994/689a15b2d072dbcf</a><br><br>That thread was talking about changing a different crypto property for XML encryption, not signature, but the idea is still the same. The code that is pointed to is a little old, you might have to fix up the dependency versions in the POM, etc, but the Spring bean source should give you an idea as to what to do. Just call:<br><br>secC<span class=pygments-n>onfig</span><span class=pygments-o>.</span><span class=pygments-na>registerSignatureAlgorithmURI</span><span class=pygments-o>(</span><span class=pygments-s>"RSA"</span><span class=pygments-o>,</span><span class=pygments-> </span><span class=pygments-n>SignatureConstants</span><span class=pygments-o>.</span><span class=pygments-na>ALGO_ID_SIGNATURE_RSA_SHA1</span><span class=pygments-o>)</span><br><br><span class=pygments-o>replacing the constant with the algorithm ID that you want.</span><br><br><span class=pygments-o>Note that that will be a global change to the IdP, for all relying parties. We have discussed possibly having support for configuring this on a relying-party specific basis in v3.</span><br><br><br><span class=pygments-o>HTH,</span><br><span class=pygments-o>Brent</span><br><br><br><br><o:p></o:p></span></p></div></body></html>