Shibboleth Developers

[Tom Scavo <>]

On Mon, Oct 25, 2010 at 11:03 AM, Scott Cantor 
<>
 wrote:
>
>> > 3. Every role descriptor SHOULD have at most one encryption key.
>>
>> We don't make such a restriction, and in fact (SP) entities often have
> more
>> than one encryption key during key rollover.
>
> Tom's point is that in theory that isn't needed, since both keys are
> available to the sofwtare, so you can switch the key rather than add them,
> *if* you control the use attribute and can distinguish signing vs.
> encryption.

Correct.

> This is true, but IMHO just makes the situation harder to understand, not
> simpler.

That's debatable, but the proof is in the pudding, I suppose. I'll
write up some documentation so folks can decide for themselves.

One thing seems clear, however. If every <md:KeyDescriptor> element in
metadata had an explicit 'use' attribute, it would be much easier for
everybody. So, as Ian observed, our tools need to support this (which
is probably the most important lesson I've learned from all of this).

Tom