Support for EC crypto?

[Cantor, Scott]

On 9/14/15, 9:25 AM, "users on behalf of Stefan Santesson" <users-bounces at shibboleth.net on behalf of stefan at aaa-sec.com> wrote:

>Well I do fault them. Correct me if I’m wrong, but the main reason for using GCM over CBC is the added data integrity protection.

Well, yes, but it's the added "this algorithm isn't broken" protection more than anything.

> But they also required signed responses, to the cipher text is already authenticated before you attempt to decrypt it.

Only if the SP actually enforces that requirement. Most don't. I added that option, but the problem with this is that the motivation to encrypt safely is not with the SP, but the IdP, so the security control needs to be there, not by requiring signed responses at the other end.

> Also. The attacks I have seen on CBC requires that you successfully can submit altered variants of the same cipher text repeatedly and track if the decryption resulted in valid datablocks. This is all good in theory, but can be prevented on so many levels in a complex protocol like SAML, where signing the response is just one of them.

I'm not aware of any such mitigations in SAML. CBC is considered broken in that context, and signed responses are the only mitigation I know of.

-- Scott