Support for EC crypto?

[Stefan Santesson]

On 14/09/15 08:21, "users on behalf of Leif Johansson" <users-bounces at shibboleth.net on behalf of leifj at sunet.se> wrote:



>>I think you are correct. I can't really fault requiring AES-GCM, since it is the only secure algorithm in XML Encryption now, but wishing doesn't make it work.

Well I do fault them. Correct me if I’m wrong, but the main reason for using GCM over CBC is the added data integrity protection. But they also required signed responses, to the cipher text is already authenticated before you attempt to decrypt it. Also. The attacks I have seen on CBC requires that you successfully can submit altered variants of the same cipher text repeatedly and track if the decryption resulted in valid datablocks. This is all good in theory, but can be prevented on so many levels in a complex protocol like SAML, where signing the response is just one of them.

But generally I agree with you. But allowing use of tested and proved code is so much better for security, than a marginally stronger crypto. Implementation errors remains the biggest threat.

>> 
>> I don't think us testing GCM or EC and getting them working properly if there's something left to do is a bad thing, but it takes a lot of time from pretty much either Brent or myself. If somebody wants to offer, I'll certainly help.
>> 
>> But I don't know anything about RSA-PSS, no.
>
>We should put some of that STORK money to good use :-)

Agree :) but these requirements are not put out there by Stork. It is a collaborative effort by experts from member states in EU, overseen by the commission.


>
>Stefan - how are your connections into the EC these days?

I hav a contract with the Commission, but with very little power to change anything unfortunately.