Help with assertion encryption ?

[Brent Putman]

On 5/20/14 1:37 PM, Tom Zeller wrote:
>>> 2014-05-19 23:30:35.483 [ERROR] :
>>> org.opensaml.xmlsec.encryption.support.Encrypter: Error encrypting
>>> XMLObject
>>> java.security.InvalidAlgorithmParameterException: Unsupported
>>> parameter: javax.crypto.spec.IvParameterSpec at 63f14c5f
>>> at com.sun.crypto.provider.CipherCore.init(CipherCore.java:509)
>>
>> That's actually more troubling.  I'll need to look into whether there's
>> more that needs to be done to actually make AES GCM work on Java 8.
> Another note : after rebuilding idp-dist with the latest code and
> configs, SSO works fine to my unchanged SP using Java 7, but the same
> error occurs with Java 8.


Ok, thanks.  That's what I was afraid of.  In looking at Santuario
XMLCipher, they seem to be doing the right thing re: generating and
using an IV.  I'll need to confirm, but it may be that in fact AES GCM
doesn't actually work on vanilla Java 8 like we thought.... 

Which also means my runtime support detection is likely also broken. 
I'm just testing that it loads the Cipher via the specified transform,
not a full end-to-end operation.  I may have to switch to doing that.
Unless our Encrypter is just not calling XMLCipher correctly in some
way, but I don't see what that is.  I'll do some more testing.