FW: [security-services] X509 Authn Attribute Profile erratum?

Hi Rick – we discussed this on the
SSTC call today.  Scott seemed to recall explicitly asking about whether
it was intending that both the Assertion and the Response must be signed, which
is what the text in the intro of section 4.0 implies.  It says that the
Response must be signed, but then sections 4.2.1 and 4.2.3 say the assertion
must be signed (yet the subsections don’t mention signing the Response).

 

If it was intended that both be signed,
then the section 4.2.1 (<Response> Usage) should be changed to state that
the response must contain a <ds:Signature> element.

 

But signing both the assertion and the
response is usually overkill unless you believe that the issuer of the
assertion is a completely different trusted entity than the sender of the
Response message.  I don’t believe that would ever be the case in
this profile.

 

I believed the intent was to just sign the
Assertion which is what sections 4.2.1 and 4.2.3 were saying.  But Scott’s
recollection called that into question.

 

Can you elaborate?        

Rob Philpott

Senior Consulting Engineer

RSA Security Inc.

Tel: 781-515-7115

Mobile:
617-510-0893

Fax: 781-515-7020

Email: 

I-name:  =Rob.Philpott

From: Philpott, Robert
[mailto:] 

Sent: Tuesday, April 11, 2006
12:19 PM

To: Ari Kermaier;


Subject: RE: [security-services]
X509 Authn Attribute Profile erratum?

 

I believe the intro is wrong and that
section 4.2.1 is correct.  I recommend changing the phrase:

 

“both by signing the <Response>
message and through TLS or SSL server authentication.”

 

To

 

“both by signing the <Assertion>
element in the <Response> message and sending the <Response> using
TLS or SSL server authentication.”

 

Rob Philpott

Senior Consulting Engineer

RSA Security Inc.

Tel: 781-515-7115

Mobile:
617-510-0893

Fax: 781-515-7020

Email: 

I-name:  =Rob.Philpott

From: Ari Kermaier
[mailto:] 

Sent: Tuesday, April 04, 2006
11:36 AM

To:


Subject: [security-services] X509
Authn Attribute Profile erratum?

 

In the overview in Section 4
"Encrypted/Signed Mode" line 194, the profile specifies that the
responding IdP MUST sign the <Response>.

 

In Section 4.2.1 "<Response> Usage" line 250
and in Section 4.2.3 "Use of Digital Signatures" line 280 it
specifies that the <Assertion> MUST be signed.

 

Which is it?

 

Ari Kermaier