IdP assertions encryption issue

[Cantor, Scott]

> When pushing data over the browser TLS is terminated at the browser in
> both cases: when connecting to the IDP web server, and again when
> connecting to the SP webserver. Meaning HTTPS cannot secure the data
> /at/ the browser, so it would be exposed to malware etc. running in
> the browser or the local OS.

The recent security bug demonstrates that XML Encryption, which I would have generally agreed was mostly a "nice to have" is in fact utterly essential to protect against lots of attacks, known and unknown.

If you want to avoid the back channel, you need encryption, full stop. Otherwise you should follow the CAS/OIDC school of thought that POST is unsafe and use callbacks.

I'm moving strongly to the "I won't do business with an SP that doesn't have a key" school of thought, and I'm glad we already baked mandatory use of it into the new saml2int proposal.

</soapbox>

-- Scott