Skip to Content.
Sympa Menu

shibboleth-dev - Re: SAML Artifact attribute

Subject: Shibboleth Developers

List archive

Re: SAML Artifact attribute


Chronological Thread 
  • From: "Tom Scavo" <>
  • To:
  • Cc: , ,
  • Subject: Re: SAML Artifact attribute
  • Date: Mon, 1 May 2006 08:34:54 -0400
  • Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=T1qCHTB95Bkgs0zSQw3Gs4JEeArDKaUi3X3hl4Nfi7SSKvhNVM8SjhOFOisOcqZxm35e/nWy3Zu8Mq83cTrO736Bb20g4O4LL0pTHOJporHs8EYlNPylWIIp5aXYvs0SYdq8jXLeJOJYP9jyW+xMU1z9T31b22uPZGPEsl2mPD8=
On 4/27/06, Scott Cantor
<>
wrote:
BTW, another data point is that IBM seems rather determined to prove that
artifact-based approaches are less secure, and I'm inclined to agree with
them. They've done analyses of both SAML 1.1 and 2.0 to demonstrate attacks
against the artifact profile/binding, but have not done so with POST.

I only know of the Gross paper (2003) referenced on the OASIS SSTC
home page. Is there another?

Thanks,
Tom

Archive powered by MHonArc 2.6.16.

Top of Page