<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/19/15 8:35 PM, Brent Putman
wrote:<br>
</div>
<blockquote cite="mid:56258C37.3000906@georgetown.edu" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<br>
Just for fun, I'll see if I can now get the IdP to sign with ECDSA
and whether the SP accepts it... <br>
</blockquote>
<br>
Doh! Should have quit while I was ahead... so far it doesn't work
for me. Getting the IdP to sign with ECDSA is easy, but the SP
doesn't accept the signature. Unless I'm doing something stupid, I
think we have an issue here as well. SP on debug:<br>
<br>
<tt>2015-10-19 21:30:33 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning
[4]: validating signature profile</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 DEBUG
XMLTooling.TrustEngine.ExplicitKey [4]: attempting to validate
signature with the peer's credentials</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 DEBUG
XMLTooling.TrustEngine.ExplicitKey [4]: public key did not
validate signature: Digital signature does not validate with the
supplied key.</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 DEBUG
XMLTooling.TrustEngine.ExplicitKey [4]: no peer credentials
validated the signature</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.PKIX [4]:
validating signature using certificate from within the signature</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.PKIX [4]:
Digital signature does not validate with the supplied key.</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 DEBUG XMLTooling.TrustEngine.PKIX [4]:
failed to verify signature with embedded certificates</tt><tt><br>
</tt><tt>2015-10-19 21:30:33 ERROR
OpenSAML.SecurityPolicyRule.XMLSigning [4]: unable to verify
message signature with supplied trust engine</tt><tt><br>
</tt><br>
<br>
<br>
If interpret the PKIX engine output correctly, it doesn't even
cryptographically validate successfully with the signature's
ds:KeyInfo data. So that implies a low-level crypto problem I
think.<br>
<br>
<br>
</body>
</html>