Table of Contents

Class SamlConstants.SignatureAlgorithms

Namespace
Fdyay.IdentityServer.Saml
Assembly
Fdyay.IdentityServer.Saml.dll

XML signature and digest algorithm URIs.

public static class SamlConstants.SignatureAlgorithms
Inheritance
SamlConstants.SignatureAlgorithms
Inherited Members

Fields

AcceptedDigestMethods

The reference digest methods this server will verify.

public static readonly IReadOnlyList<string> AcceptedDigestMethods

Field Value

IReadOnlyList<string>

Remarks

Separate from the signature method because XML-DSig lets them differ, and a sender pairing an RSA-SHA256 signature with a SHA-512 digest is doing nothing wrong. What must not pass is a weak hash at either position: a strong signature over a SHA-1 digest proves only that the sender vouched for a digest anybody can collide.

AcceptedSignatureMethods

The signature methods this server will verify. Pinned in code, not configurable.

public static readonly IReadOnlyList<string> AcceptedSignatureMethods

Field Value

IReadOnlyList<string>

Remarks

Six rather than one as of 0.62.0, and still an allow-list rather than a setting: the recorded posture is that narrow and pinned is right for this server, and what was wrong was the shape of the narrowing — one algorithm, so a partner whose certificate is EC could not be talked to at all.

Both families carry all three hashes on purpose. SHA-384 being acceptable under EC and refused under RSA would be a rule applied to one of its halves with nothing behind the line: the property worth keeping is "SHA-256 or stronger", and SHA-1 is absent from both because it is broken for signatures, not because of which key made it.

EcdsaSha256

ECDSA signature over SHA-256 (RFC 6931).

public const string EcdsaSha256 = "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"

Field Value

string

EcdsaSha384

ECDSA signature over SHA-384 (RFC 6931).

public const string EcdsaSha384 = "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"

Field Value

string

EcdsaSha512

ECDSA signature over SHA-512 (RFC 6931).

public const string EcdsaSha512 = "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"

Field Value

string

EnvelopedSignature

The enveloped-signature transform, which removes the signature from the element it signs before digesting (XML Signature Syntax and Processing).

public const string EnvelopedSignature = "http://www.w3.org/2000/09/xmldsig#enveloped-signature"

Field Value

string

ExclusiveC14n

Exclusive XML Canonicalization without comments, the canonicalization and transform SAML signatures use (Exclusive XML Canonicalization 1.0).

public const string ExclusiveC14n = "http://www.w3.org/2001/10/xml-exc-c14n#"

Field Value

string

RsaSha256

RSA PKCS#1 v1.5 signature over SHA-256 (RFC 6931).

public const string RsaSha256 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"

Field Value

string

RsaSha384

RSA PKCS#1 v1.5 signature over SHA-384 (RFC 6931).

public const string RsaSha384 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"

Field Value

string

RsaSha512

RSA PKCS#1 v1.5 signature over SHA-512 (RFC 6931).

public const string RsaSha512 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"

Field Value

string

Sha256

The SHA-256 digest method (XML Encryption Syntax and Processing).

public const string Sha256 = "http://www.w3.org/2001/04/xmlenc#sha256"

Field Value

string

Sha384

The SHA-384 digest method (RFC 6931).

public const string Sha384 = "http://www.w3.org/2001/04/xmldsig-more#sha384"

Field Value

string

Sha512

The SHA-512 digest method (XML Encryption Syntax and Processing).

public const string Sha512 = "http://www.w3.org/2001/04/xmlenc#sha512"

Field Value

string