<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 7/6/16 6:43 PM, Klingenstein, Nate
wrote:<br>
</div>
<blockquote
cite="mid:CE072648-FD39-4640-A272-A2180FD74D96@calstate.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>
<blockquote type="cite" class=""><span style="background-color:
rgb(255, 255, 255);" class="">And the documented metadata
for the TestShib SP does list the GCM ones first also:</span><br
class="">
<div class=""><br style="font-family: Helvetica; font-size:
12px; font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; orphans:
auto; text-align: start; text-indent: 0px; text-transform:
none; white-space: normal; widows: auto; word-spacing:
0px; -webkit-text-stroke-width: 0px; background-color:
rgb(255, 255, 255);" class="">
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.testshib.org/metadata/testshib-providers.xml"
style="font-family: Helvetica; font-size: 12px;
font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; orphans:
auto; text-align: start; text-indent: 0px; text-transform:
none; white-space: normal; widows: auto; word-spacing:
0px; -webkit-text-stroke-width: 0px; background-color:
rgb(255, 255, 255);">http://www.testshib.org/metadata/testshib-providers.xml</a><br
style="font-family: Helvetica; font-size: 12px;
font-style: normal; font-variant-caps: normal;
font-weight: normal; letter-spacing: normal; orphans:
auto; text-align: start; text-indent: 0px; text-transform:
none; white-space: normal; widows: auto; word-spacing:
0px; -webkit-text-stroke-width: 0px; background-color:
rgb(255, 255, 255);" class="">
</div>
</blockquote>
</div>
<br class="">
<div class="">If there's a different ordering or set of algorithms
that would be preferred by the developers, we could make that
change pretty easily. I don't think we've encountered a problem
with it prior to this, though, and if anything, it's probably
good that it got caught.<br>
</div>
<br>
</blockquote>
<br>
No, it's not really in general a problem per se. We in general want
GCM mode to be used if it's supported, so it really ought to be
listed first.<br>
<br>
The only problematic edge case deployment-wise is it you have
deliberately configured an *older* version of BC <= 1.50. I
highly suspect that is what the OP has. But maybe he can confirm at
some point.<br>
<br>
If you have Java 7 + BC >=1.51, it will work fine I think. And
if you haven't configured BC at all (the vast majority case for most
people), then it will either successfully do AES CBC (Java 7) or AES
GCM (Java 8), given that metadata. In the former case AES GCM isn't
supported by the runtime, so it falls through to the later
algorithms in the list in metadata.<br>
<br>
</body>
</html>