InCommon Technical Discussions

["Wessel, Keith" <>]

IMHO, separate certs for signing and encryption is not only a good idea, but it’s going to become more popular now that we have improved support for it in the Shibboleth IdP and SP.

 

The AAF’s federation registry allows just one on registration, but once registered, you can upload a new one and use checkboxes to indicate signing and/or encryption. This is similar to what InCommon has today, of course. It’s an extra step, though, and it’s confusing.

 

Best usability experience, I think, would be two radio buttons: “Use the same certificate for signing and encryption” and “Use different certificates for signing and encryption”. Then, through the miracles of fancy web design, either one or two boxes would be made available to copy certs into. Bonus points for an option to browse and upload the cert from the client’s computer.

 

Of course, encryption certificates for the IdP are rather silly. An authn request or logout request serves no purpose being encrypted by the SP. I can see some edge cases where and IdP might want to publish an encryption cert for those purposes, but I’m at a loss to understand what the use case would be.

 

For the SP, though, this is a big deal or soon will be and, from a security standpoint, should be encouraged.

 

Keith

 

 

From: <> On Behalf Of Nick Roy
Sent: Friday, September 6, 2019 12:48 PM
To:
Subject: [InC-Technical] Dual use versus separate keys for signing and encryption

 

Hi all,

This is the start of that thread I mentioned on the participants list, regarding your preferences for ability to select SAML key use in the Federation Manager.

Please let me know if you have thoughts about what we should be doing with regards to allowing people to specify separate key uses/upload multiple keys at once/etc.

Thank you,

Nick