<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 25, 2014 at 2:05 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div id=":6ae" class="" style="overflow:hidden">What I presumed was that they were also doing some kind of key rollover here and/or starting to use SHA-2 at runtime, and any or all of that could still be the case. And key rollover would matter a lot of course.<br>
<br>
But few vendors do any signing at runtime when they're the SP, so that seems unlikely in hindsight. Unless they do support encryption, which would be a key rollover concern, but they're not likely to do that as part of some kind of SHA-1 retirement plan.</div>
</blockquote></div><br>Ok.. so both copies of the metadata have different certs in</div><div class="gmail_extra"><div class="gmail_extra"> <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div>
<div><div> <ds:KeyInfo></div><div> <ds:X509Data></div><div> <ds:X509Certificate></div></div><div><br></div><div><div class="gmail_extra">Both copies of the metadata have unique values in </div>
<div class="gmail_extra"><div class="gmail_extra"> <ds:KeyValue></div><div class="gmail_extra"> <ds:RSAKeyValue></div><div class="gmail_extra"> <ds:Modulus></div>
<div><br></div></div></div><div>The certs show up a second time, later in the metadata</div></div><div class="gmail_extra"><div class="gmail_extra"> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div>
<div class="gmail_extra"> <md:KeyDescriptor use="encryption"></div><div class="gmail_extra"> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div>
<div class="gmail_extra"> <ds:X509Data></div><div class="gmail_extra"> <ds:X509Certificate></div><div class="gmail_extra"><br></div></div><div class="gmail_extra"><br></div><div class="gmail_extra">
My impression is that they're planning on rolling out a new signing cert as part of their move to sha256.</div><div class="gmail_extra"><div class="gmail_extra"> ...we still need to know if you were able to get SHA256 support </div>
<div class="gmail_extra"> working in a way that allows you to have both certs available, so that there’s</div><div class="gmail_extra"> no outage incurred when we switch the encryption certificate on our side to</div>
<div class="gmail_extra"> SHA256...</div><div class="gmail_extra"><br></div><div class="gmail_extra">Liam</div></div><div class="gmail_extra"><br></div></div>