Search code examples
samlsaml-2.0adfsadfs2.0pingfederate

In SAML, is there a point for Assertion Level Encryption if we are already communicating via SSL?


Is there a point for implementing Assertion Level Encryption (and Attribute Level Encryption) if we are already communicating via SSL (https)?


Solution

  • If you're using the browser profile, whereby the SP and IdP exchange messages via the user's browser, SSL alone does not protect against a man-in-the-middle in all cases. Take for example the scenario where a user is on unsecured Wi-Fi and a malicious user intercepts traffic, swapping a self-signed SSL cert for the CA-issued one. If a user clicks through the warning, their transport-level security is negated and confidentiality may be breached. If on the other hand the sensitive parts of the assertion are protected via message level encryption, the man-in-the-middle in the above scenario still cannot read the message despite the user's poor judgement, and confidentiality is ensured.