<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 7/6/16 6:27 PM, Brent Putman wrote:<br>
</div>
<blockquote
cite="mid:d9776dd0-c738-39cd-3a55-470ef0f8bd69@georgetown.edu"
type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 7/6/16 5:40 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE11298BFD2@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite"><br>
<pre wrap="">I don't think we're using GCM by default for XML Encryption though, are we? </pre>
</blockquote>
<br>
Not by default, but it would if the metadata said to via the
algorithm extensions (which I think the Shib SP metadata does by
default IIRC) </blockquote>
<br>
Yeah, the generated SP metadata is doing this by default, at least
on the version we have on shibboleth.net:<br>
<br>
<tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2009/xmlenc11#aes128-gcm">"http://www.w3.org/2009/xmlenc11#aes128-gcm"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2009/xmlenc11#aes192-gcm">"http://www.w3.org/2009/xmlenc11#aes192-gcm"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2009/xmlenc11#aes256-gcm">"http://www.w3.org/2009/xmlenc11#aes256-gcm"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">"http://www.w3.org/2001/04/xmlenc#aes128-cbc"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmlenc#aes192-cbc">"http://www.w3.org/2001/04/xmlenc#aes192-cbc"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmlenc#aes256-cbc">"http://www.w3.org/2001/04/xmlenc#aes256-cbc"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmlenc#tripledes-cbc">"http://www.w3.org/2001/04/xmlenc#tripledes-cbc"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2009/xmlenc11#rsa-oaep">"http://www.w3.org/2009/xmlenc11#rsa-oaep"</a>/></tt><tt><br>
</tt><tt> <md:EncryptionMethod
Algorithm=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">"http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"</a>/></tt><br>
<br>
<br>
<br>
So the IdP will attempt to do GCM if it sees peer metadata like
that, and if it detects runtime support for GCM.<br>
</body>
</html>