AES-GCM in Shibboleth SP

[Cantor, Scott]

On 9/24/20, 9:57 AM, "users on behalf of Silke Meyer" <users-bounces at shibboleth.net on behalf of smeyer at dfn.de> wrote:

>    * As of which version is AES-GCM supported?

The SP isn't the issue, various libraries are. xml-security-c 1.7.0 is when GCM got implemented, and the OpenSSL requirement is probably around 1.0.1 (but that's a guess).

You rarely have to guess. Any SP that's reachable will spit out the algorithms in the /Shibboleth.sso/Metadata results, that's far and away the best (really only) value of that endpoint.

>    * Does it have to be turned on via config 

No.

>    * As of which version is it the default?

The SP doesn't encrypt often, and when it does, that's not the default even now because we haven't done a major release that would have allowed for such a change.

-- Scott