Encrypting OIDC secrets in static metadata

[Peter Schober]

Wessel, Keith via users <users at shibboleth.net> [2024-10-01 00:04 CEST]:
> I see that OIDC client secrets in the IdP can now be SHA hashed
> which, as the documentation says, doesn't encrypt them but at least
> slightly obfuscates them.

Not only "slighly", they're completely obfuscated. ;)

Provided you're using sufficiently long client secrets (large possible
keyspace) you wouldn't have to worry about rainbow tables and other
offline attacks from all but the most powerful attackers, I think.

That doesn't mean I'd be keen on persisting them in a VCS (where
they'll never be removed, in practice) but I also wouldn't lose any
sleep over it atm (i.e., until SHA2 for long, complex passphrases is
breakable with realistically available resources, at which point it'll
be time to change those secrets).

-peter