<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/20/15 9:34 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:EAF28A3B-D8FA-4E25-897A-3ABB12D9086D@osu.edu"
type="cite">
<pre wrap="">On 10/20/15, 7:42 AM, "users on behalf of Jarno Huuskonen" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofjarno.huuskonen@uef.fi"><users-bounces@shibboleth.net on behalf of jarno.huuskonen@uef.fi></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">(I had to disable encryption for that SP in (idp: relying-party.xml),
this is probably because xmlenc keytransport algorithms
use rsa?:
</pre>
</blockquote>
<pre wrap="">
Yes, I don't support ECDH encryption.</pre>
</blockquote>
<br>
Neither does the IdP yet [1], hopefully in the near future it will.
But just noting that you should be able to have both an EC key and
an RSA key in the SP's metadata, and the IdP will encrypt with the
RSA key.<br>
<br>
I think I also had encryption turned off for my test but I can
easily test that later today. Those really should orthogonal and I
can't foresee any reason why that wouldn't work.. <br>
<br>
<blockquote cite="mid:EAF28A3B-D8FA-4E25-897A-3ABB12D9086D@osu.edu"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I tested that SP can verify ecdsa signed metadata, so ecdsa signed
response probably works.
</pre>
</blockquote>
<pre wrap="">
Apparently not. What was the metadata signed with?</pre>
</blockquote>
<br>
Yeah, I had the same question. What toolset, library, etc was
used? If it's something Java-based, then that's hopeful, and maybe
I just screwed something up in my IdP->SP test.<br>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/OSJ-82">https://issues.shibboleth.net/jira/browse/OSJ-82</a><br>
<br>
<br>
<blockquote cite="mid:EAF28A3B-D8FA-4E25-897A-3ABB12D9086D@osu.edu"
type="cite">
</blockquote>
<br>
</body>
</html>