Issues in using OpenSAML 4.x in FIPS compliant applications

[Paul Henson]

On 8/15/2023 6:54 PM, Cantor, Scott via dev wrote:

> The investigation Paul just did is what we would have done at some
> point provided somebody filed a bug about it. I certainly wasn't
> going to do that work to answer the basic question.

Heh, I'm going to write it off to the advertising budget and curiosity :).

> I will say it seems pretty disadvantageous to me for the
> package names to be different between them. Unless those classes are
> programmatically loaded

Ah, after a more detailed review it looks like the only use of them is 
in the KDF code which is replaced with something else by the 
opensaml.config.ecdh.defaultKDF property, so shouldn't be an issue.

opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java:import 
org.bouncycastle.crypto.digests.RIPEMD160Digest;
opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java:import 
org.bouncycastle.crypto.digests.SHA1Digest;
opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java:import 
org.bouncycastle.crypto.digests.SHA224Digest;
opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java:import 
org.bouncycastle.crypto.digests.SHA256Digest;
opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java:import 
org.bouncycastle.crypto.digests.SHA384Digest;
opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java:import 
org.bouncycastle.crypto.digests.SHA512Digest;



-- 
Signet - The Art of Access
https://www.signet.id/