Repository navigation
Crypto-Agility update: ECDSA, ML-DSA, SLH-DSA signature verification #80
Description
Our federation publishes metadata with four algorithms simultaneously: RSA, ECDSA, ML-DSA, SLH-DSA (the latter two being PQC algorithms for future quantum readiness).
metarefresh currently appears to understand exclusively RSA, judging from the failing signature validation for the other three variants:
10:53:14.176Z [metarefresh]: Executing set [eduID-LU]
10:53:14.178Z [metarefresh]: In set [eduID-LU] loading source [http://www.eduid.lu/metadata/upstream-rsa.xml]
10:53:14.412Z Found 28 entities
10:53:22.006Z Writing: /export/hosting/restena/clueless/private/deploy-test/simplesamlphp-2.5.3.1/metadata/metadata-eduID-LU/saml20-sp-remote.php
10:53:23.210Z [metarefresh]: Executing set [eduID-LU-ECDSA]
10:53:23.228Z [metarefresh]: In set [eduID-LU-ECDSA] loading source [http://www.eduid.lu/metadata/upstream-ecdsa.xml]
10:53:23.428Z Could not validate signature
10:53:23.428Z Skipping "https://clueless.restena.lu/simplesaml_dev/saml2/idp/metadata.php" - could not verify signature using certificate.
[...]
10:53:23.440Z Found 28 entities
10:53:23.441Z [metarefresh]: Executing set [eduID-LU-MLDSA]
10:53:23.441Z [metarefresh]: In set [eduID-LU-MLDSA] loading source [http://www.eduid.lu/metadata/upstream-mldsa.xml]
10:53:23.593Z Could not validate signature
10:53:23.593Z Skipping "https://clueless.restena.lu/simplesaml_dev/saml2/idp/metadata.php" - could not verify signature using certificate.
[...]
10:53:23.607Z Found 28 entities
10:53:23.607Z [metarefresh]: Executing set [eduID-LU-SLHDSA]
10:53:23.608Z [metarefresh]: In set [eduID-LU-SLHDSA] loading source [http://www.eduid.lu/metadata/upstream-slhdsa.xml]
[...]
10:53:23.787Z Found 28 entities
The config points to the respective signing certificates as per config below. eduGAIN is able to validate these files with an independent implementation so the files and signing certs are known good.
This is happening on simpleSAMLphp 2.5.3.1 and metarefresh 1.3.1.
'sets' => [
'eduID-LU' => [
'cron' => ['daily'],
'sources' => [
[
'types' => ['saml20-sp-remote'],
'src' => 'http://www.eduid.lu/metadata/upstream-rsa.xml',
'certificates' => [ 'eduID-rsa.pubcert', ]
],
],
'expireAfter' => 60*60*24*365, // Maximum 365 days cache time.
'outputDir' => 'metadata/metadata-eduID-LU/',
'outputFormat' => 'flatfile',
],
'eduID-LU-ECDSA' => [
'cron' => ['daily'],
'sources' => [
[
'types' => ['saml20-sp-remote'],
'src' => 'http://www.eduid.lu/metadata/upstream-ecdsa.xml',
'certificates' => [ 'eduID-ecdsa.pubcert', ]
],
],
'expireAfter' => 60*60*24*365, // Maximum 365 days cache time.
'outputDir' => 'metadata/metadata-eduID-LU-ECDSA/',
'outputFormat' => 'flatfile',
],
'eduID-LU-MLDSA' => [
'cron' => ['daily'],
'sources' => [
[
'types' => ['saml20-sp-remote'],
'src' => 'http://www.eduid.lu/metadata/upstream-mldsa.xml',
'certificates' => [ 'eduID-mldsa.pubcert', ]
],
],
'expireAfter' => 60*60*24*365, // Maximum 365 days cache time.
'outputDir' => 'metadata/metadata-eduID-LU-MLDSA/',
'outputFormat' => 'flatfile',
],
'eduID-LU-SLHDSA' => [
'cron' => ['daily'],
'sources' => [
[
'types' => ['saml20-sp-remote'],
'src' => 'http://www.eduid.lu/metadata/upstream-slhdsa.xml',
'certificates' => [ 'eduID-slhdsa.pubcert', ]
],
],
'expireAfter' => 60*60*24*365, // Maximum 365 days cache time.
'outputDir' => 'metadata/metadata-eduID-LU-SLHDSA/',
'outputFormat' => 'flatfile',
],
Activity
tvdijen commentedon Oct 30, 2026
I've made a start here:
simplesamlphp/xml-security#99