Skip to Content.
Sympa Menu

shibboleth-dev - Re: Encryption key strategies

Subject: Shibboleth Developers

List archive

Re: Encryption key strategies


Chronological Thread 
  • From: "Tom Scavo" <>
  • To:
  • Subject: Re: Encryption key strategies
  • Date: Thu, 22 Jun 2006 10:17:14 -0400
  • Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=HJnAeIr5aIXWrIS6B8LNF8gG2WIx0J8NuJsElOsRXlkcGjC021bLMbi7NYhQ0kdRJ1gokGv1mCGxPLFYBEiX0tJmwgc020GFGqfi187rPFFqIAgFRWvip0tWUiTfAmDvBzXBvHfLD+9xWzwooIZB1bVKKPt3uwrvGZMQyF1QFKE=
On 6/22/06, Chad La Joie
<>
wrote:
As I said, there is no specification that says how to do this. What you
propose may make sense in certain circumstances, but it's not a standard
way to do it and there is no way for either party to stipulate that
they're expecting the relying part to do it this way.

There are multiple ways to call out support of such a profile. Scott
and I discussed this on saml-dev recently, and he suggested the
following metadata approach:

<AttributeService
xprof:hasSupport="true"

xmlns:xprof="urn:oasis:names:tc:SAML:profiles:query:attributes:X509-encrypted"
Binding="..."
Location="..."/>

This is missing from the specification as advertised, but I'm
rewriting the document as we speak.

Tom

Archive powered by MHonArc 2.6.16.

Top of Page