Shibboleth Developers

["Scott Cantor" <>]

> There are multiple ways to call out support of such a profile.  Scott
> and I discussed this on saml-dev recently, and he suggested the
> following metadata approach:

It doesn't matter, though. None of this is part of SAML 2.0, and we're
talking about standard use of encryption within the base schema for use by
all profiles. What you're describing isn't supported by commercial products.
It's not "can we do it?", it's "do we need to?" and "does it solve the key
management problem?" and I think the answers there are both no.

I am not worried at this point about key reuse (which BTW is also considered
bad form anyway in encryption, isn't it?). It's not part of any specs,
nobody implements it yet, and it's not a solution to my question.

-- Scott