Help with assertion encryption ?

[Brent Putman]

On 5/20/14 12:47 PM, Tom Zeller wrote:
> Yes, I was sure it was EncryptAssertions. Snippets of the Java 7 and
> Java 8 stack traces follow.

Ok, it clearly is.  I don't really have an explanation.  Maybe some
stale artifacts or config files somewhere?  Something somewhere is/was
specifying AES GCM, but I don't know what it is.  It would be good to
find out.


>
> However, after updating OpenSAML this morning and revisiting, I don't
> see these errors anymore, just debug log messages from the
> AlgorithmRegistry that it "Cannot find any provider supporting
> AES/GCM/NoPadding" etc, which seems fine.


Yeah, that is normal.  All registered AlgorithmDescriptors, including
AES GCM variants, are pulled in by the AlgorithmRegistry initializer,
but now they get evaled at registration time and their runtime support
status stored.  That's then used to prevent them effectively being used
if the runtime environment doesn't support.


>
> 2014-05-19 23:30:35.483 [ERROR] :
> org.opensaml.xmlsec.encryption.support.Encrypter: Error encrypting
> XMLObject
> java.security.InvalidAlgorithmParameterException: Unsupported
> parameter: javax.crypto.spec.IvParameterSpec at 63f14c5f
> at com.sun.crypto.provider.CipherCore.init(CipherCore.java:509)


That's actually more troubling.  I'll need to look into whether there's
more that needs to be done to actually make AES GCM work on Java 8.