<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 2/8/17 4:45 PM, Cantor, Scott wrote:<br>
</div>
<blockquote cite="mid:EF8FEA3A-422A-4943-B4A6-8FB83F73D24B@osu.edu"
type="cite">
<pre wrap="">On 2/8/17, 4:33 PM, "users on behalf of Klingenstein, Nate" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofnklingenstein@calstate.edu"><users-bounces@shibboleth.net on behalf of nklingenstein@calstate.edu></a> wrote:
</pre>
<pre wrap="">
You can't encrypt with a DSA key in any way we support, so that is the issue.</pre>
</blockquote>
<br>
Indeed. DSA is not supported for (direct) encryption period, XML or
otherwise. (I'm not counting indirect use e.g. in TLS for
authenticating key exchange and then ephemeral DH).<br>
<br>
Static/fixed Diffie-Hellman is mathematically akin to DSA (the
discrete log problem). And fun fact: you can actually have a cert
with fixed DH key info. But I've never seen one and I think many TLS
libs like openssl don't even support that mode, even though it's
defined in the SSL/TLS spec.<br>
<br>
<br>
<blockquote cite="mid:EF8FEA3A-422A-4943-B4A6-8FB83F73D24B@osu.edu"
type="cite">
<pre wrap=""> Possibly logging for that needs to improve (though maybe it shows up if you logged the category Brent named), though encountering something once every 5 years doesn't exactly scream high priority.
</pre>
</blockquote>
<br>
Looking again at Nate's log, I think he only has DEBUG on for the
IdP. Had he had it (or TRACE) on for opensaml, or at least those 2
packages I mentioned, he would have gotten some hints from at least
the SAML params resolver, like:<br>
<br>
For every candidate key transport cred:<br>
<br>
<tt>log.trace("Evaluating key transport encryption credential from
SAML metadata of type: {}", key != null ? key.getAlgorithm() :
"n/a");</tt><br>
<br>
When it failed to resolve any supported algorithm for that candidate
cred:<br>
<br>
<tt>log.debug("Unable to resolve key transport algorithm for
credential with key type '{}', " + "considering other
credentials", </tt><br>
<br>
<br>
In some of of the lower level code on at least TRACE, there's also
logging of the cred's key's algorithm type.<br>
<br>
<br>
<br>
</body>
</html>