role of public key in encrypted assertion

[Peter Schober <peter.schober@univie.ac.at>]

Hi. I just recived the message below from an SP/RP we're trying to
federate with. Logins (SAML2.0 WebSSO with encrypted assertions) fail
at their end (custom SAML implementation, AFAICT) and our IdP
implementation is put to the blame for that.

While I'd prefer to have the SP tell me specifically what part of
which spec they think we're violating (instead of shifting the burdon
of proof to me to show that we're in compliance) I'd like to get this
sorted out ASAP and so would ask for something I can quote to the SP,
or hints to the relevant spec.

> The problem is that the certificate for IDP
> https://idp.example.org/saml is different in the metadata and in the
> SAML Response.
> 
> Metadata certificate
> <ds:X509Certificate>
[removed public key of our IdP]
> </ds:X509Certificate>
> 
> SAML Response certificate
> <ds:X509Certificate>
[removed public key of the SP, to which the assertion was encrypted]
> </ds:X509Certificate>

This message (that's all of it) seems to imply that the incriminated
key at:
/Response/EncryptedAssertion/xenc:EncryptedData/ds:KeyInfo/xenc:EncryptedKey/ds:KeyInfo/ds:X509Data/ds:X509Certificate
should be the IdP's public key.
From glancing over XMLenc (section 3.5.1) and section 3.2.2 of the old
"SAML Implementation Guidelines" (returned by $searchengine) I
conclude that the SP's public key is included in order to inform the
SP which of its keys had been used to encrypt the payload (encryption
key).
Furthermore my guess is that the SP's tech-c (writing the above to me)
is mistaken and thinks of (unencrypted) XMLsig, where it would make
sense to include the issuer's public key in order to aid the SP in
verifying the issuer's signature.

Thanks,
-peter