Security defaults

[Brent Putman]

On 5/12/14 1:01 PM, Cantor, Scott wrote:
> On 5/12/14, 12:52 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>> The main question at this point is to decide what the OpenSAML-level
>> defaults should actually be, e.g. do we favor SHA-256 over SHA-1 at this
>> level, etc.  I think I also TODO'ed populating any whitelist/blacklist
>> values, e.g. should we blacklist MD5 algos by
>> default? (Remember that higher order precedence configs may or may not
>> be merged with lower order ones, based on a config flag.)  Maybe we can
>> discuss in this thread, or in another one.
> I was imagining we'd probably adopt the same blacklist we use in the SP
> right now as a starting point, but it doesn't affect the code much so I
> haven't worried about it.
>
> I am assuming we would default to SHA-256 (with RSA and ECDSA) as the
> primary algorithms for signing. That seems to be the consensus expectation.


I just checked in the draft default OpenSAML algorithms in
DefaultSecurityConfigurationBootstrap.  Let me know if anyone disagrees
with anything there.

I put in some inline comments to note where ordering and grouping was
significant or not, in case that is unclear.

Remember that config instances with a higher order of precedence may
duplicate these in their lists, with a different ordering, with as few
or as many as desired (i.e. you don't need to enumerate them all, just
the ones you want to express at that particular config level).