<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/21/15 10:11 AM, Cantor, Scott
wrote:<br>
</div>
<br>
<blockquote cite="mid:DF25999C-7DCD-405B-8466-B82C479294AC@osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">I changed idp to use ecdsa cert -> SP fails to validate ecdsa signed
saml2p:Response. (Also xmlsectool.sh and xmlsec1 fail to validate this
ecdsa signed response:
</pre>
</blockquote>
<pre wrap="">
That's fairly indicative that there's perhaps a regression in Santuario 2.x.
</pre>
</blockquote>
<br>
I'm nominally agree, but...<br>
<br>
<blockquote cite="mid:DF25999C-7DCD-405B-8466-B82C479294AC@osu.edu"
type="cite">
<pre wrap="">
and doesn't work:
- IDP fails when SP sends ecdsa signed request to Redirect binding
- SP fails to verify ecdsa response from IDP
</pre>
<pre wrap="">
In in both those cases, that's Santuario 2.x computing the signature (to verify it or to create it), so that fits that hypothesis.</pre>
</blockquote>
<br>
Actually the first case of the Redirect binding signature failing
validation at the IdP isn't Santuario. It's not involved at all,
because it's not XML. Just plain old use of the Java JCA Signature
class. (That's the Java side. I assume on the SP side you're just
using openssl directly to compute the raw signature?)<br>
<br>
The second is Santuario of course.<br>
<br>
AFAIK the only thing in common between the 2 would be the JCA
Signature support (which Santuario uses internally). So either
there's a fundamental issue there (seems unlikely? we wouldn't be
the first to encounter I think), or else the 2 cases are failing for
probably unrelated reasons.<br>
</body>
</html>