<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 9/23/22 1:24 AM, Nate Klingenstein
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CA+eXai4C93x=-z7VZbN_ffh9kbMx+HP1MdJLa31ZC1OPsfa=hA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">Jeremy,
<div>
<div><br>
</div>
<div>The sad answer is that the SP can specify which cipher
suites are acceptable to it through the use of metadata,
but few IdP's actually honor it. Shibboleth does.</div>
<div><br>
</div>
<div><a href="http://2.4.1.1" moz-do-not-send="true">2.4.1.1</a>:</div>
<div><br>
</div>
<div><a
href="https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf"
moz-do-not-send="true" class="moz-txt-link-freetext">https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf</a><br>
</div>
<div><br>
</div>
<div>e.g.</div>
<div><br>
</div>
<div>
<div><a href="https://samltest.id/saml/sp"
moz-do-not-send="true" class="moz-txt-link-freetext">https://samltest.id/saml/sp</a></div>
<div><br>
</div>
<div> <md:EncryptionMethod Algorithm="<a
href="http://www.w3.org/2009/xmlenc11#aes256-gcm"
moz-do-not-send="true" class="moz-txt-link-freetext">http://www.w3.org/2009/xmlenc11#aes256-gcm</a>"/><br>
</div>
</div>
</div>
</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>All true, but as I just noted in previous message, the original
question here is about weak EC curves. Those aren't going to be an
"algorithm" one indicates in metadata like that, since they are
properties of the EC keys themselves. However, the answer is
easier. For encryption (to you) don't put a key with a weak curve
in your metadata that you give to other parties. Done. For signing
(by you), same answer.</p>
<p>For encryption (by you) and signature validation (signatures sent
to you), you need local policy enforcement, like an algorithm
include/exclude list (formerly known as whitelist/blacklist).<br>
</p>
</body>
</html>