it's Oracle update day

[Ian Young]

The latest Java updates from Oracle (10.0.1, 8u171, 7u181, 6u191) make a couple of cryptographic changes. I don't _think_ they are particularly relevant for us, but here they are:

* To improve the strength of SSL/TLS connections, 3DES cipher suites have been disabled in SSL/TLS connections in the JDK via the jdk.tls.disabledAlgorithms Security Property.

* The secure validation mode of the XML Signature implementation has been enhanced to restrict EC keys less than 224 bits by default. The secure validation mode is enabled either by setting the property org.jcp.xml.dsig.secureValidation to true with the javax.xml.crypto.XMLCryptoContext.setProperty() method, or by running the code with a SecurityManager.

Note that although there's a 10.0.1, there is no update to Java 9 as it is now regarded as obsolete.

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3854 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20180419/f93905d1/attachment.p7s>