Experience with SPs requiring 'large' symmetric encryption keys

[Cantor, Scott]

On 4/8/13 6:39 PM, "Tom Poage" <tfpoage at ucdavis.edu> wrote:

>Looking to see who might have run across SAML SPs (not necessarily
>Shibboleth) which use symmetric encryption keys large enough a
>Shibboleth IdP must run with JCE Unlimited Strength Jurisdiction Policy
>JARs (default max. cipher size for most types is 128 bits, including AES).

The IdP doesn't do any decryption, so it has no exposure to that issue
unless you were to get it to generate keys used for encryption that
happened to be too big (which would then fail).

>Trying to decide whether to continue operating our IdP with these policy
>files in place.

Well, AES192 and AES256 are certainly common enough algorithms. But it
uses AES128 by default I believe so probably isn't affected by that choice
in most cases.

-- Scott