FW: SAML and EBMS 3.0 [SEC=UNCLASSIFIED]

Hi All,

Received the following from one of my colleagues in the Australian Government. I am assuming that dual signing is neither desirable nor intended. Is this something we can discuss and clarify?

Regards, Ian.

Ian Otto
Security Architect
VANguard and Infrastructure Branch
eBusiness Division
__________________________________________

Department of Industry, Innovation,
Science, Research and Tertiary Education

SAP House, Level 8.49, Bunda Street, Canberra City ACT 2600
GPO Box 9839, Canberra ACT 2601
Ph: +61-2-6276 1660 Fax: +61-2-6213 6684
Mobile: +61 403 458 215
Email: Ian.Otto@innovation.gov.au
Internet: http://www.innovation.gov.au
ABN 74 599 608 295

From: Jones, Dean (Security Architect) [mailto:Dean.Jones@ato.gov.au]
Sent: Wednesday, 29 May 2013 5:45 PM
To: Young, Malcolm; Otto, Ian
Subject: SAML and EBMS 3.0 [SEC=UNCLASSIFIED]

Hi Malcolm, Ian,

There are currently some discussions going on here about the EBMS standard. I was pulled in to give my opinion about the following extract from the standard and how it affects us using SAML with EBMS.

Without looking deeply into the context my answer was that SAML could not be used as the sole mechanism for message integrity. If SAML signing were used (and we didn't want to break the standard) then we would have a dual signed EBMS message.

Do you have a different view?

Thanks.

2328 7.2. Signing Messages
2329 Signing of ebMS Messages is defined in Web Services Security [WSS10] and [WSS11]. Support for 2330 WSS X.509 Certificate Token Profile is REQUIRED to sign a message.

<<ebms_core-3.0-spec.zip>>

Dean Jones
Security Architect

Middleware and Common Services /
Integrated Common Services
Ph: 621 64369
Mobile: 0407 452 388

**********************************************************************
IMPORTANT
The information transmitted is for the use of the intended
recipient only and may contain confidential and/or legally
privileged material. Any review, re-transmission, disclosure,
dissemination or other use of, or taking of any action in
reliance upon, this information by persons or entities other
than the intended recipient is prohibited and may result in
severe penalties. If you have received this e-mail in error
please notify the Privacy Hotline of the Australian Taxation
Office, telephone 13 2869 and delete all copies of this
transmission together with any attachments.
**********************************************************************

*************************************************************************
The information contained in this e-mail, and any attachments to it,
is intended for the use of the addressee and is confidential. If you
are not the intended recipient you must not use, disclose, read,
forward, copy or retain any of the information. If you received this
e-mail in error, please delete it and notify the sender by return
e-mail or telephone.

The Commonwealth does not warrant that any attachments are free
from viruses or any other defects. You assume all liability for any
loss, damage or other consequences which may arise from opening
or using the attachments.

The security of emails transmitted in an unencrypted environment
cannot be guaranteed. By forwarding or replying to this email, you
acknowledge and accept these risks.
*************************************************************************

ebxml-msg message