DataSealer error

[Russell Beall]

In case someone is watching this, the update went live this weekend and went off without a hitch.

BouncyCastle is in the number 1 spot, and when debugging levels are turned up, I see it used as:
DEBUG [org.opensaml.xml.signature.SignatureValidator:64] - Validation credential key algorithm 'RSA', key instance class 'org.bouncycastle.jce.provider.JCERSAPublicKey'

This is as opposed to:
'sun.security.rsa.RSAPublicKeyImpl"

which also works, not being part of PKCS11.

The situation looks good, however, before anyone else puts BouncyCastle in the number one spot, the installation instructions should be referenced:
http://www.bouncycastle.org/specifications.html#install

and note the line where it says "issues arise when the Sun providers are not first".  I wish I had seen that before trying it, but luckily, there have been none of those "issues".

Eventually I plan to drop it out altogether, since it isn't needed and isn't helpful.  I've tested large key sizes without it and they seem to work now even though keys larger than 4096 bits aren't supposed to work according to (possibly old) documentation from Sun regarding the policy files not really leading to true Unlimited strength.  Large keys work in the IdP but I can't get the SP to sign messages with keys larger than 4096 bits because of SSL library errors in the SP.  This might be because the SP I was testing with is an older one, 2.3.1.  Somehow the SP was able to decrypt messages received at 8192bits even though it had trouble going the other way.

I notice that the fix to the JCE provider also fixes the earlier issue I had with the DataSealer keystore.  I can now use a 192-bit keysize or even a 256-bit keysize regardless of whether or not BouncyCastle is set as a JCE provider.

Regards,
Russ.



On Aug 5, 2011, at 8:45 AM, Chad La Joie wrote:

> That is correct.  The IdP does not use bouncy castle as a JCE
> provider, only as a helper library for reading in and inspecting
> cryptographic stuff (e.g., keys, certs).
> 
> On Fri, Aug 5, 2011 at 11:21, Cantor, Scott E. <cantor.2 at osu.edu> wrote:
>> On 8/4/11 10:50 PM, "Russell Beall" <beall at usc.edu> wrote:
>>> 
>>> BouncyCastle is trusted and used within the IdP internally, correct?
>> 
>> I believe we use it for things like ASN.1 parsing. To use it for actual
>> cryptography requires modifying the JVM in the fashion you did, the IdP
>> doesn't assume that.
>> 
>> -- Scott
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> 
> 
> 
> 
> -- 
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net