SAML Encryption

1
SAML Encryption
2
Functionality

• Encrypt Assertion
• Encrypt NameIdentifier (Schema valid)
• Encrypt Attribute (Schema valid)
• Excluded
• Arbitrary encryption
• Encrypted AttributeValue (w/o AttributeName)

3
Approach

• NameIdentifier Attribute
• Scotts select technique
• Assertion
• Replace with EncryptedData
• (and optional EncryptedKey)

4
Order of Operations

• Super-encryption allowed (use questionable)
• Signed Assertion
• Encrypted Assertion
• Sign then encrypt
• Encrypted NameIdentifier Attribute
• Encrypt then sign
• Signed Request or Response
• Encrypt then sign

5
Issue - Assertion Encryption

• Encrypt Assertion Content
• Not Schema Valid (use Scotts technique)
• Encrypt Assertion Element
• Potentially two elements (data key)
• In SOAP body violates WS-I BP
• (Need wrapper)
• Drop functionality?