PE: Disallow Object element in signatures

XMLWordPrintable

    • Hide

      Modify SAML Core by inserting a new section 5.4.5:

      5.4.5 Object

      The <ds:Object> element is not defined for use with SAML signatures, and SHOULD NOT be present. Since it can be used in service of an attacker by carrying unsigned data, verifiers SHOULD reject signatures that contain a <ds:Object> element.

      Show
      Modify SAML Core by inserting a new section 5.4.5: 5.4.5 Object The <ds:Object> element is not defined for use with SAML signatures, and SHOULD NOT be present. Since it can be used in service of an attacker by carrying unsigned data, verifiers SHOULD reject signatures that contain a <ds:Object> element.
    • Hide

      Resolved as proposed on TC call on Aug 9, 2011:
      http://lists.oasis-open.org/archives/security-services/201108/msg00021.html

      Show
      Resolved as proposed on TC call on Aug 9, 2011: http://lists.oasis-open.org/archives/security-services/201108/msg00021.html

      The XML Signature profile in SAML Core doesn't explicitly disallow the use of the <ds:Object> element in signatures, although it's discouraged by implication given the other restrictions imposed. Since the element is often used to carry out wrapping attacks, and its use was never profiled, we should discourage it explicitly.

            Assignee:
            Scott Cantor (Inactive)
            Reporter:
            Scott Cantor (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: