Versions Compared

Old Version 37

changes.mady.by.user trscavo@internet2.edu

Saved on

compared with

New Version 38

changes.mady.by.user trscavo@internet2.edu

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This document is a plan to implement the Phase 1 Recommendations of the Metadata Distribution WG. For more detailed information, see the Phase 1 Implementation Plan FAQ.

Executive Summary

  1. On December 18, 2013, InCommon Operations will deploy three new metadata aggregates at the following permanent HTTP locations:
    • http://md.incommon.org/InCommon/InCommon-metadata.xml (production metadata)
    • http://md.incommon.org/InCommon/InCommon-metadata-fallback.xml (fallback metadata)
    • http://md.incommon.org/InCommon/InCommon-metadata-preview.xml (preview metadata)
  2. All new metadata aggregates will be signed using a new self-signed signing certificate set to expire on December 18, 2037.
    • Although the signing certificate is new, the signing key is not.
  3. All new metadata aggregates will be signed with the same key but the fallback metadata aggregate will use a different digest algorithm.
    • The production metadata aggregate will be signed using a SHA-2 digest algorithm (specifically, SHA-256).
    • Initially, the fallback metadata aggregate will be signed using the SHA-1 digest algorithm (which is what we use now).
    • Initially, the preview metadata aggregate will be aliased to the production metadata aggregate.
  4. All deployments shall migrate to one of the new metadata aggregates ASAP but no later than March 29, 2014.
    • The current metadata aggregate will be replaced with a redirect to the fallback metadata aggregate on March 29, 2014.
    • If your metadata process can verify an XML signature that uses the SHA-256 digest algorithm, migrate to either the production metadata aggregate or the preview metadata aggregate.
    • If your metadata process can not verify an XML signature that uses the SHA-256 digest algorithm, migrate to the fallback metadata aggregate.
  5. All deployments shall be able to verify an XML signature that uses a SHA-256 digest algorithm by June 30, 2014.
    • On June 30, the fallback metadata aggregate will be synced with the production metadata aggregate (i.e., all aggregates will be signed using the SHA-256 digest algorithm).
    • After June 30, all metadata aggregates published by the InCommon Federation will be signed using the SHA-256 digest algorithm.

...