Help with assertion encryption ?

[Cantor, Scott]

On 5/21/14, 3:30 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>Anyway, the executive summary at this point is that:
>1) AES GCM doesn't work for XML Encryption on plain Java 8, unlike what
>we previously thought
>2) fixing it involves 1-2 libraries that are not ours
>3) fixing it looks like it's going to be more complex than it ideally
>would be

Yeah, I was never very confident this worked, there really wasn't ever any
effort from Sean or Colm to test this. I couldn't get anybody interested
because Java 7 didn't include it.

I was very against GCM becoming the solution to the XML Encryption
problems, and not surprisingly the JSON specs didn't have the same
obstinate people standing in the way of the right thing, which was to
adopt a manual concatenation of regular CBC encryption and an HMAC.

-- Scott