Closed baszoetekouw closed 1 year ago
@pmeulen , @thijskh, @quartje and me discussed this over lunch. Our conclusion was that the current behaviour (i.e., requiring signed SAML if the attribute payload is encrypted) is sane, and going back to the old behaviour is not a sustainable solution. There are two possible way going forward:
Ongoing progress on how to fix this bug is kept in https://wiki.surfnet.nl/display/OpenConext/Ciphers+en+encryption
I've concluded my investigation, and afraid the news is not good. Of the three main IdP product (ADFS, SSP, Shib), only Shibboleth support aes-gcm ciphers. Neither ADFS or SSP support anything else than aes-cbc. Therefore, the easy way to fix this bug (namely: require IdPs to use aes-gcm instead of aes-cbc ciphers) isn't going to work.
Do you agree that this is fixed since EB 5.1?
I don't know. Has anyone tested encrypted IdPs recently? @surfnet-niels?
I've concluded my investigation, and afraid the news is not good. Of the three main IdP product (ADFS, SSP, Shib), only Shibboleth support aes-gcm ciphers. Neither ADFS or SSP support anything else than aes-cbc. Therefore, the easy way to fix this bug (namely: require IdPs to use aes-gcm instead of aes-cbc ciphers) isn't going to work.
This is now no longer the case I think as AES-GCM is now relatively mainstream.
Also signing of responses is now mainstreamly available.
I propose to close this now and 'fix' encryption (if any needed) when someone has a concrete need that can also directly confirm or deny which approach works for them.
Demand for encryption is growing with each cloud-service we connect... Along with Artifact-binding..
Encryption support is there.. so by all means try to use it so we know what to change to fix it (if any)
In #120, encryption support for EngineBlock was severely limited. Specifically, Shib IdPs with a default setup can no longer be used to authenticate to Engineblock. For SURFconext is is not really a big issue at the moment, but for OpenConext, it is a major problem.
Recap: to work around a chosen-ciphertext attack in the AES-CBC cipher (#116) used for assertion encryption, @relaxnow and @pmeulen implemented a fix: IdPs that encrypt the assertion are now required to sign the entire SAML Response. This properly fixes the problem, as confirmed by @jurajsomorovsky, who was involved in the ROS security assessment on SURFconext.
However, this fix breaks saml2int compliance (as @joostd remarked), and makes Engineblock incompatible with recent Shib IdP versions (which refuse to send unencrypted assertions unless explicitly told to).
Therefore, please reenable support for unsigned, encrypted assertions. In the original thread (#120), @pmeulen suggested the following fix:
However, @jurajsomorovsky in #116 remarked:
which suggest that removing support for AES-CBC altogether might also break standards-compliance.
Another way to solve this might be to address the original issue (#116):
which should be easy to fix.