<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 5/20/14 6:49 PM, Brent Putman wrote:<br>
</div>
<blockquote cite="mid:537BDBEC.60505@georgetown.edu" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<tt><br>
</tt><tt>AlgorithmParameterSpec algParamSpec = new
GCMParameterSpec(128, iv);</tt><br>
<br>
<br>
So that looks promising. If that is the case, then the issue is
with Santuario. It probably needs to special case for GCM. I
just tested that mechanism with BC on Java 7 and it works also.
So perhaps that is the new "proper" way to do GCM, but BC doesn't
require it for historical reasons and Santuario is just lagging
behind and written to the older more lax BC way. At least I hope
so.<br>
</blockquote>
<br>
<br>
I'm pretty convinced that this is the way you're supposed to do it.
I wrote a quick and dirty patch to XMLCipher that does this
(attached), and successfully encrypted and decrypted using AES 128
GCM with Java 8 and no BC.<br>
<br>
However... turns out GCMParameterSpec only showed up in the API with
Java 1.7. AFAICT Santuario is still, even in their latest 2.0.0
release, targeting 1.6. So... I don't think this will necessarily be
a straightforward. They may in fact be aware of this issue
already, and haven't fixed it for the versioning reason. Tomorrow
when I'm more sure of my facts, I'll post something to the xmlsec
list.<br>
<br>
I did find this:<br>
<br>
<a class="moz-txt-link-freetext" href="http://mail.openjdk.java.net/pipermail/security-dev/2013-July/008079.html">http://mail.openjdk.java.net/pipermail/security-dev/2013-July/008079.html</a><br>
<br>
so Sean Mullan may already be aware of this. <br>
<br>
<br>
<br>
</body>
</html>