The AES cookie encryption key - how many bits?

[Cantor, Scott]

On 1/30/16, 7:21 PM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:



>What's the current bit size of the AES key generated for encrypting the cookie? Wondering about the wiki recommendation for generating a new key once a day, and exactly how important that is. I thought I'd seen the bit size listed in the wiki before, but if its there, I'm missing it.

It's 128, partly to avoid the JCE restrictions.

Changing it frequently is a way of encouraging people to not ignore it, and making sure the code accomodates it, same reason OIC apparently tries to force constant key rotations to avoid the problems SAML had with lazy implementers refusing to even think about it.

-- Scott