[JIRA] (JCOMOIDC-45) Add a Decrypter for JWE tokens similar to the opensaml Decrypter

[Brent Putman (Jira)]

Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) *commented* on JCOMOIDC-45 ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45?atlOrigin=eyJpIjoiNmJkODI0M2NiMzA5NGY5ZmJiNzkyYWFhOTMxMTYyNjYiLCJwIjoiaiJ9 )

Re: Add a Decrypter for JWE tokens similar to the opensaml Decrypter ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45?atlOrigin=eyJpIjoiNmJkODI0M2NiMzA5NGY5ZmJiNzkyYWFhOTMxMTYyNjYiLCJwIjoiaiJ9 )

Just to elaborate on my concerns on the “try them all until one succeeds” approach…

At least for RSA, it seems to work ok on the native SP, with openssl + Santuario C++.

However, in Java, we actually don’t know that this works reliably. We’ve never done it that way, we’ve always done it based on hints from the message data.

A specific concern, that we’ve seen in other Java crypto areas before, is that some JCA providers may treat non-sensical or non-sane input as fundamentally illegal, and throw an unchecked runtime exception. That would cause the current model to blow up and not work, if that occurs before the correct one.

Examples that come to mind:

* trying an RSA private key whose modulus is a different size than the one used to encrypt
* trying an EC private key whose curve parameters don’t match the params of the 2 keys used in the original agreement op

And it’s provider specific. We once saw something similar to this where the Oracle JDK-supplied “SunWhatever” provider was ok with some input, but BC blew up on it, or vice versa.

So it just feels to me like a bug waiting to happen.

( https://shibboleth.atlassian.net/browse/JCOMOIDC-45#add-comment?atlOrigin=eyJpIjoiNmJkODI0M2NiMzA5NGY5ZmJiNzkyYWFhOTMxMTYyNjYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JCOMOIDC-45#add-comment?atlOrigin=eyJpIjoiNmJkODI0M2NiMzA5NGY5ZmJiNzkyYWFhOTMxMTYyNjYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100202- sha1:e905ae5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/97556d8d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d674a45c-9f51-499e-b761-cc788c362c5e
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/97556d8d/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-109abb5b-be2f-4f51-b2c6-316cf5916ff3
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/97556d8d/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ea092c4d-ad6b-4d65-b102-2b3abb584f0a
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220714/97556d8d/attachment-0005.png>