Seeking feedback on default encryption algorithm for V4

[Cantor, Scott]

We're finalizing the V4 defaults, and apart from a few obvious ones, the biggest remaining question is whether to flip the default encryption algorithms from AES-CBC over to AES-GCM for new installs. Upgrades would need to inherit the existing default, so we're not going to actually change the default internally, but the shipping configuration can be set differently, much as with the local storage change.

I think it's now or never to do this, because there is no time at which there will be a majority of non-Shibboleth SPs that support GCM, so the situation is not going to be materially different later. It just is what it is: CBC is and has been broken for a decade and the only safe algorithm available is GCM. Virtually all but the most outdated Shibboleth SPs support it. I have no idea what else does and just take the default position that most nothing does. I'm sure a few do, but it's an easier planning assumption.

So there's no illusion that it won't require effort by deployers to use it, and if people want to just not care and toggle the property off, they're free to do that.

I just think we're obligated to ship secure configurations as best we can, and that is the only secure configuration we have.

Admittedly, I'm also less impacted by the fallout because apart from member support, I really just don't have to care too much what trouble this causes. So I'm inclined to go along with the majority on it.

-- Scott