<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2/7/2020 2:22 PM, Cantor, Scott
(quoting Chris Phillips) wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CY4PR0101MB3096524B1B21B3AF5A0CB7B5D01C0@CY4PR0101MB3096.prod.exchangelabs.com">
<blockquote type="cite" style="color: #000066;">
<pre class="moz-quote-pre" wrap="">How about using existing logstream in idp-warn.log and log non GCM
transactions with "WARN -- lower strength algorithm in use, recommend to
<entityid> to have better as this will be deprecated in the future." message?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">I don't know what that would accomplish, really. There isn't enough use of the algorithm metadata to be significant, is there? I would expect nothing but warnings, and there's no way to know what could be fixed and what couldn't.</pre>
</blockquote>
<p>I'd have to wonder if the set of SPs with published algorithm
support in their metadata overlaps completely with the set of SPs
that support AES-GCM...</p>
<p>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">The simple fact is people don't value the encryption or they would have cared about this a long time ago.
</pre>
</blockquote>
</p>
<p>These days I'd expect most/all transport of the encrypted
response/assertion would be over TLS, which is enforcing its own
encryption (likely GCM if you're using a relatively current
browser). So the only real risk of exposure would be via browser
shenanigans, and if the attacker controls the browser, it doesn't
seem like it buys them much to crack open the authN response when
they can use it as-is to access the SP directly.</p>
<p>So while I question the effective value of changing the default,
I like the way you're proposing changing it. New installations
can use the new default, and work things out as they onboard SPs,
while upgrades are left alone. And deployer get a switch to flip
the way they want either way, and can switch to the new default
when it's convenient (or a clever new hack makes it necessary).<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>