Seeking feedback on default encryption algorithm for V4

[Cantor, Scott]

> I'd have to wonder if the set of SPs with published algorithm support in their
> metadata overlaps completely with the set of SPs that support AES-GCM...

In a sense, but I don't think we believe that every such SP supports GCM. I would agree that I believe the majority that support GCM also happen to be Shibboleth, but many/most federations don't publish that metadata extension, so it's not that prevalent.

> These days I'd expect most/all transport of the encrypted response/assertion
> would be over TLS, which is enforcing its own encryption (likely GCM if you're
> using a relatively current browser).  So the only real risk of exposure would be
> via browser shenanigans, and if the attacker controls the browser, it doesn't
> seem like it buys them much to crack open the authN response when they can
> use it as-is to access the SP directly.

It mitigates a lot of past and future attacks against the plaintext caused by XML bugs and signature bugs, but admittedly the full mitigation would depend on requiring signed responses, which SPs don't generally require. It definitely raises the bar for attackers, they can't just trivially add comment nodes and such. There are many SPs out there still vulnerable to that bug.

So it's a very nice thing to have because it lets you largely bypass a lot of extra testing. I realize I'm one of the few doing that sort of testing, but...it is what it is.

-- Scott