Experience with SPs requiring 'large' symmetric encryption keys

[Tom Poage]

On 04/08/2013 03:45 PM, Cantor, Scott wrote:
> The IdP doesn't do any decryption, so it has no exposure to that issue

Ahh, right. Forgot that.

>> Trying to decide whether to continue operating our IdP with these policy
>> files in place.
> 
> Well, AES192 and AES256 are certainly common enough algorithms. But it
> uses AES128 by default I believe so probably isn't affected by that choice
> in most cases.

Agreed. Saw this comment in JavaCryptoValidationInitializer.java which got me wondering

> // XML Encryption spec requires AES support (128 and 256).

Part of the motivation behind my question is I'd thrown together a RedHat/CentOS/... RPM to install the Java 7 JCE 'unlimited strength' policy JARs and persist them across Java (java-1.7.0-oracle) updates. I don't recall seeing (SAML specs) whether an SP can request--or, more importantly, require--a minimum (encryption) security strength in returned assertions, so maybe the point of making the RPM more widely available is moot. Works with it, works without. :-)

Thanks.
Tom.