<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 3/15/15 11:04 PM, Rhian Resnick
wrote:<br>
</div>
<blockquote cite="mid:1426475070358.92452@fau.edu" type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"><strong></strong>Evening,</div>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"><br>
</div>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">We
are testing IDP 3.1 and discovered that when <a
moz-do-not-send="true"
href="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
id="LPlnk923566">http://www.w3.org/2001/04/xmlenc#tripledes-cbc</a>
is listed first in the SP's metadata first the following error
is generated. We are running Oracle JDK 8 r40 on Tomcat8. We can
work around this by changing the order of possible encrypting
key algorithms or removing tripledes-cbc, but we did find it odd
and thought you might have seen this before. <br>
</div>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"><br>
</div>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"><strong>Exception:</strong></div>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"><br>
<div>2015-03-15 22:14:43,593 - ERROR
[net.shibboleth.idp.saml.profile:-2] - Uncaught runtime
exception</div>
<div>java.security.InvalidParameterException: Wrong keysize:
must be equal to 112 or 168</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>at
com.sun.crypto.provider.DESedeKeyGenerator.engineInit(DESedeKeyGenerator.java:94)</div>
<br>
</div>
</blockquote>
<br>
<br>
Yes, I'm familiar with the general issue. IIRC the Java JCA stuff
is somewhat inconsistent in what they consider to be the key size
for triple DES keys. Some security provider impls treat it as 192
and some treat it as 168 (or 112 if the DESede variant which reuses
the first DES key as the third key also).<br>
<br>
I think it has to do with: Original DES keys were defined as 64
bits. However 8 bits were defined as parity bits. This was back
(in the 70's I think) when communications channels weren't so
reliable, so they built some parity bits right into the key itself.
Or something like that. So anyway, only 56 bits of actual key
material.<br>
<br>
So depending on whether they treat a DES key as 56 vs 64 bits, some
impls treat a triple DES key as either 168 or 192. <br>
<br>
I'll look into it.<br>
</body>
</html>