DataSealer error

[Cantor, Scott E.]

On 8/8/11 7:34 PM, "Russell Beall" <beall at usc.edu> wrote:
>Sun regarding the policy files not really leading to true Unlimited
>strength.  Large keys work in the IdP but I can't get the SP to sign
>messages with keys larger than 4096 bits because of SSL library errors in
>the SP.

It's not SSL, it's XML signing. I'm not aware of any OpenSSL limitations,
but that's not impossible either. I just won't be able to do anything
about that.

>  This might be because the SP I was testing with is an older one, 2.3.1.
> Somehow the SP was able to decrypt messages received at 8192bits even
>though it had trouble going the other way.

I wouldn't have expected either direction to work, it crashes both ways
under testing when an unpatched xml-security is used.

>I notice that the fix to the JCE provider also fixes the earlier issue I
>had with the DataSealer keystore.  I can now use a 192-bit keysize or
>even a 256-bit keysize regardless of whether or not BouncyCastle is set
>as a JCE provider.

Note Nicholas Roy's identification of a bug in SPs using non-traditional
storage plugins because the SP violates the API contract on the size of
the entry keys if the NameID is large. Using AES128 is suggested at this
point.

-- Scott