Java crypto roadmap

[Ian Young]

Potentially relevant to our interests, recently updated:

https://java.com/en/jre-jdk-cryptoroadmap.html

Some highlights:

* TLS 1.3 coming to Java 8 (?!) some time in 2020. So, not dead then. Supposedly announced in July although I don't remember seeing that. I can't see this one affecting anyone negatively.

* TLS 1.0 and TLS 1.1 being *disabled* in all versions of Java from Java 7 onwards, second half of 2020. This is new and will presumably affect existing deployments if they take the relevant Java update (which I have to assume a lot of people will).

I don't think there are a lot of circumstances in which this would affect the IdP, as it doesn't initiate connections very often, but:

* A really old SP doing attribute query might be affected.

* The IdP might be affected if it was fetching metadata from an HTTPS location that was too old to support TLS 1.2. That sounds like an unlikely combination.

Am I missing anything?

    -- Ian

P.S. You can disable TLS 1.0 and TLS 1.1 today as described here, if you want: https://java.com/en/configure_crypto.html#DisableTLS


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20191016/7d266a6a/attachment.p7s>