[java-opensaml COMMIT] /trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurat...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon May 19 21:56:16 2014
New Revision: 3890

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3890&view=rev
Log:
Blacklist RSA 1.5 KeyTransport by default.
Remove default config for RIPEMD160 algorithms.  These aren't even supported in Java 8 out of the box, need BC.

Modified:
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurationBootstrap.java

Modified: trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurationBootstrap.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurationBootstrap.java?rev=3890&r1=3889&r2=3890&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurationBootstrap.java (original)
+++ trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurationBootstrap.java Mon May 19 21:56:16 2014
@@ -66,6 +66,10 @@
     @Nonnull public static BasicEncryptionConfiguration buildDefaultEncryptionConfiguration() {
         BasicEncryptionConfiguration config = new BasicEncryptionConfiguration();
         
+        config.setBlacklistedAlgorithms(Sets.newHashSet(
+                EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15
+                ));
+        
         config.setDataEncryptionAlgorithms(Lists.newArrayList(
                 // The order of these is significant.
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
@@ -77,7 +81,6 @@
         config.setKeyTransportEncryptionAlgorithms(Lists.newArrayList(
                 // The order of the RSA algos is significant.
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP,
-                EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15,
                 
                 // The order of these is not significant.
                 // These aren't really "preferences" per se. They just need to be registered 
@@ -102,6 +105,10 @@
     @Nonnull public static BasicDecryptionConfiguration buildDefaultDecryptionConfiguration() {
         BasicDecryptionConfiguration config = new BasicDecryptionConfiguration();
         
+        config.setBlacklistedAlgorithms(Sets.newHashSet(
+                EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15
+                ));
+        
         config.setDataKeyInfoCredentialResolver(buildEncryptionDataKeyInfoCredentialResolver());
         config.setKEKKeyInfoCredentialResolver(buildEncryptionKEKKeyInfoCredentialResolver());
         config.setEncryptedKeyResolver(buildBasicEncryptedKeyResolver());
@@ -132,7 +139,6 @@
                 SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384,
                 SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512,
                 SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1,
-                SignatureConstants.ALGO_ID_SIGNATURE_RSA_RIPEMD160,
                 
                 // ECDSA
                 SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256,
@@ -147,8 +153,7 @@
                 SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                 SignatureConstants.ALGO_ID_MAC_HMAC_SHA384,
                 SignatureConstants.ALGO_ID_MAC_HMAC_SHA512,
-                SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
-                SignatureConstants.ALGO_ID_MAC_HMAC_RIPEMD160
+                SignatureConstants.ALGO_ID_MAC_HMAC_SHA1
                 ));
         
         config.setSignatureReferenceDigestMethods(Lists.newArrayList(
@@ -156,8 +161,7 @@
                 SignatureConstants.ALGO_ID_DIGEST_SHA256,
                 SignatureConstants.ALGO_ID_DIGEST_SHA384,
                 SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                SignatureConstants.ALGO_ID_DIGEST_RIPEMD160
+                SignatureConstants.ALGO_ID_DIGEST_SHA1
                 ));
         
         config.setSignatureCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);