Sometimes It's Better to Be STUCK! SAML Transportation Unit for Cryptographic Keys

Over the last decade the Security Assertion Markup Language (SAML) framework evolved to a versatile standard for exchanging security statements about subjects. Most notably, SAML facilitates the authentication of users, and is thus deployed in both Webservice (SOAP, WS-Security) and REST-based (SAML SSO webbrowser profile, SAML Bearer token in OAuth) services. But at least SAML provides no standardized, overall solution to transport key material. This paper recommends an extension, STUCK the SAML Transportation Unit for Cryptographic Keys, to the SAML framework which provides an easy way to transport cryptographic key material bound to assertions issued by particular subjects. The proposal fits into existing solutions and is fully compliant with the Security Assertion Markup Language, XML Digital Signature and XML Encryption standards.