Scott,<div><br></div><div>Our SP and the IDP to which we are connecting are currently required to XML-encrypt anything sensitive going out over the front channel. This includes the Assertion and the NameID, which is why you see our front-channel logout request with the encrypted NameID.<div>
<br></div><div><div>I believe your previous description of the limited benefits of going beyond SHA1 in the case of the EncryptedKey will be good enough... I had checked the XML Encryption spec before following up here to see if SHA256 "mapped", but I also understand it's not always that easy.</div>
<div><br></div><div>We are able to force the signature & its digest algorithm to sha256 without any issues, which will hopefully be sufficient.</div><div><br></div><div>Thanks again for the assistance.</div><div>Marc</div>
<div><br></div><div><br></div><div><br><div class="gmail_quote">On Wed, Apr 18, 2012 at 12:23 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 4/17/12 1:59 PM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
><br>
>> Is there any way to force this digest algorithm an SHA256 as well? It<br>
>>seems to<br>
>> default to SHA1 regardless of value in digestAlg attribute.<br>
><br>
>No, there is no option for it. I don't recall if the APIs even allow for<br>
>it on the encrypting end (I know mine don't, but I'm not sure Santuario's<br>
>do either).<br>
<br>
</div>Just FYI, I checked into this, and can confirm that there's no current<br>
mechanism I could use to set this to something else in Santuario. I don't<br>
think I can fit in a change of that significance to the 2.5 SP release, so<br>
I wouldn't expect it.<br>
<br>
Note that the SP really doesn't encrypt much of anything. Your example was<br>
a logout. You could just turn off encryption of the NameID and avoid the<br>
problem. Particularly in light of the problems with CBC encryption that<br>
really show no sign of being fixable.<br>
<br>
I filed a RFE to track the need for the API change:<br>
<a href="https://issues.apache.org/jira/browse/SANTUARIO-311" target="_blank">https://issues.apache.org/jira/browse/SANTUARIO-311</a><br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div></div>