OASIS SAML Security and Privacy 2.0
Title: Security and Privacy Considerations for the OASIS Security Assertion Markup Language (SAML) V2.0
Category: Authentication Procotol Specification
Date: 3/15/2005
Creator: OASIS
URL: http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf
Description: Provides security and privacy considerations for users of SAML 2.0, including some specific implementation
requirements (such as mandatory cryptographic algorithms to be supported) but more extensive discussion
of threats and countermeasures to be considered when profiling SAML 2.0.
Privacy: There is discussion of achieving privacy through confidentiality of the transaction and a discussion of
pseudonymity. Privacy protections implemented for PII at rest seems to be out of scope.
Security: The threat analysis within explains design choices within SAML or informs the developers of SAML profiles.
The document requires SHA-1 with no mention of more robust hash algorithms (SHA-256 etc did not exist in
2005), requires Triple DES and suggests but does not mandate AES.
Interoperability: The document specifies TLS cipher suites that are required to be supported.
Terms: