idpv3: clustering and sealer key update

[Cantor, Scott]

On 3/15/15, 7:45 AM, "Jarno Huuskonen" <jarno.huuskonen at uef.fi> wrote:
>
>I did some (very very quick) testing (w/3.0.0) and it looks like it reads
>the new key from disk --> so it's able to decrypt the cookie but I think
>it still (re)encrypts with the "current" key (until updateInterval).

That would have been my guess.

>If you use the datasealer only for encrypted "shib_idp_session_ss" cookies
>then would it make sense to limit the number of old keys to only a few and
>update the sealer key often, so current/old keys cover for example
>24h --> This would limit the time an attacker has for "faking" a valid
>"shib_idp_session_ss" cookie to 24h ?

Yes, that was the original thought process when the only data being protected was short lived, but that's no longer really the case.

FWIW, the default history size in the key utility in 3.1 has been altered to be 30 keys instead of 3 in recognition of the other use cases.

-- Scott