Help with assertion encryption ?

[Brent Putman]

On 5/20/14 6:30 PM, Brent Putman wrote:
> Maybe you can't init it with an IvParameterSpec, perhaps it requires
> something different. 

Yeah, that seems like it might be it.  I just looked for all subclasses
of AlgorithmParameterSpec, and I found GCMParameterSpec.  I just tried
it in place of the IvParameterSpec, and it works for Java 8 like so:


byte[] iv = generateBytes(96/8);
////AlgorithmParameterSpec algParamSpec = new IvParameterSpec(iv);
AlgorithmParameterSpec algParamSpec = new GCMParameterSpec(128, iv);


So that looks promising.  If that is the case, then the issue is with
Santuario.  It probably needs to special case for GCM.  I just tested
that mechanism with BC on Java 7 and it works also.  So perhaps that is
the new "proper" way to do GCM, but BC doesn't require it for historical
reasons and Santuario is just lagging behind and written to the older
more lax BC way.  At least I hope so.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140520/c2ca88ad/attachment.html