<div dir="ltr">Maybe it would help if I rephrased things.<div><br><div>We have two pieces of SP metadata for Gartner - both using the same entityID, and the same endpoint URLs.</div><div>One metadata file is signed using sha1, and includes certificate A.</div>
</div><div>The other metadata file is signed using sha256, and includes certificate B.</div><div><br></div><div>Is it possible / correct / valid to combine both pieces of metadata into a single EntityDescriptor entry that contains both that sha1 and sha256 signatures (and the certs used to generate them)?</div>
<div><br></div><div>Liam</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 25, 2014 at 12:13 PM, Tom Scavo <span dir="ltr"><<a href="mailto:trscavo@gmail.com" target="_blank">trscavo@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On Wed, Jun 25, 2014 at 12:02 PM, Liam Hoekenga <<a href="mailto:liamr@umich.edu">liamr@umich.edu</a>> wrote:<br>
><br>
> >> Can it contain multiple signature algorithms?<br>
> ><br>
> > It doesn't contain any, not for the signer anyway.<br>
><br>
> Then what's this stuff?<br>
><br>
> <ds:SignedInfo><br>
> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" target="_blank">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/><br>
> <ds:Reference URI="#BWECV5asjkQuYobLAI6P5nzg6Gs"><br>
> <ds:Transforms><br>
> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><br>
> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><br>
> </ds:Transforms><br>
> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256" target="_blank">http://www.w3.org/2001/04/xmlenc#sha256</a>"/><br>
> <ds:DigestValue>Vc2rDL5mk1+e+E7TUKiAv7PgJsai6c9u0MQVjkkhkFb=</ds:DigestValue><br>
> </ds:Reference><br>
> </ds:SignedInfo><br>
<br>
</div>That's why I said I didn't quite understand your question. The above<br>
looks like a partial signature on the metadata itself, which of course<br>
has nothing to do with end entity certificates in metadata.<br>
<span class="HOEnZb"><font color="#888888"><br>
Tom<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>