FW: [#6949] Question sent to support

We received this question by a somewhat indirect route. Perhaps someone can answer and copy Mr. Khoo on the response.

Hal

From: Mary McRae [mailto:marypmcrae@gmail.com] On Behalf Of Mary McRae
Sent: Wednesday, March 28, 2007 2:58 PM
To: leonardl@gama-tech.com
Cc: '[SUPPORT] Neil Schelly'
Subject: [#6949] Question sent to support

Hello Leonard,

I am forwarding your message to the chairs of the Security Services TC; they should be able to respond to your question. You can find more information about SAML here:

http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security

There is also a saml-dev discussion list where you can post questions:

mailto:saml-dev-subscribe@lists.oasis-open.org

Regards,

Mary P McRae

Manager of TC Administration, OASIS

email: mary.mcrae@oasis-open.org

web: www.oasis-open.org

phone: 603.232.9090

OASIS Symposium:
"eBusiness and Open Standards:
Understanding the Facts, Fiction, and Future"
15-18 April 2007 San Diego, CA USA
http://www.oasis-open.org/events/symposium/

-------------------------

Hi Support,
I'm writing to enquire about the standard of encyrption for the source ID for
a SAML producer/provider.
At the moment we observed that most vendors use SHA-1 Hash of the Site ID which
result in a 40 hexadecimal character.
However some implementation uses combination of encryption like SHA-1 Hash of
the Site ID bytes value followed by Base64 encode.

So our question is what is the standard set by oasis for SAML 1.1 and 2.0 ?
Please refer to the below for the corresponding source ID example.

Regards,
Leonard Khoo
Mobile: +852 61899259

ba356b0a7d9814a5f6b5e313419c58d6b8fe199b (40 hexadecimal char)
OdI7mFJKX6aDqxfiNC7fHKzApjs= (site id bytes->sha1 hash->base64)