Shibboleth Developers

["Scott Cantor" <>]

> The docs you quoted referred to an *input* format, presumably to
> construct a certificate.

No, I was just pasting from the manpage of the openssl rsa command. Inform
and outform are the same options and formats. Nothing to do with
certificates at all.

> I thought you and Jim were discussing a
> format to pass from the SP to the application, in which case I don't
> see how constructing a certificate applies (which I think Jim said, in
> so many words).  So I'm confused, and I'll shut up until I understand
> the context better :-)

We are discussing that, but my feeling has been that a mechanism that
communicates the actual key is better than a hash if it's possible to do so.
In this case it may be more work than it's worth, so using some kind of SKI
approach might be the best middle ground (a semi-standard sort of hash).

-- Scott