Default digest and signing algorithms are weak and considered no longer secure

[obi1kenobi]

SHA1 is broken, both in theory and in practice. Earlier this year, a team of researchers demonstrated a practical collision attack, producing two different files that hash to the same value: https://shattered.io/

On the current master branch:

• pysaml2 uses SHA1 as its default digest algorithm:
  https://github.com/rohe/pysaml2/blob/9cbbd9bd9f6bfa5e9ceace064dd1af4e2ff2f68c/src/saml2/xmldsig/__init__.py#L23
• pysaml2 uses RSA-SHA1 as its default signing algorithm: https://github.com/rohe/pysaml2/blob/9cbbd9bd9f6bfa5e9ceace064dd1af4e2ff2f68c/src/saml2/xmldsig/__init__.py#L46

To fix this, SHA256 should be the default digest algorithm, and RSA-SHA256 the default signing algorithm.

Additionally, SHA1 is used for HMAC purposes, as HMAC-SHA1: https://github.com/rohe/pysaml2/blob/9cbbd9bd9f6bfa5e9ceace064dd1af4e2ff2f68c/src/saml2/xmldsig/__init__.py#L54
While the HMAC construction isn't obviously broken by the SHA1 developments above, it's probably a good idea to switch this to HMAC-SHA256 since there's no downside to simply using a stronger algorithm.

[jkakavas]

Practical for a state sponsored adversary, and the ability to create an XML document which will have the same signature with a SAML Response that you want to forge is still a couple of years away, but definitely LGTM. Would you care to send us a PR with the default algorithms replaced ?

[obi1kenobi]

The file has a comment saying Generated Mon May 2 14:23:33 2011 by parse_xsd.py version 0.4.

Is there a process I should use to generate a new file, or should I simply edit the existing file in-place?

[peppelinux]

See #597
and also:
IdentityPython/SATOSA#214 (comment)

[peppelinux]

Move this issue here:
#421

thank you, it's still in progress ...