[MYFACES-4376] Update Cryptographic algorithm in StateUtils to a stronger version

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-RC1, 2.3-next-M4, 4.0.0-RC1
• Fix Version/s: 2.3-next-M5, 3.0.0, 4.0.0-RC1
• Component/s: General
• Assignee: Bernd Bohmann
• Reporter: Bernd Bohmann
• Created: 19/Jan/21 11:25
• Updated: 10/Feb/21 20:19
• Resolved: 08/Feb/21 15:17

Description

Change the parameters

org.apache.myfaces.ALGORITHM  from DES to AES

and

org.apache.MAC_ALGORITHM  from HmacSHA1 to HmacSHA256 

DES and HmacSHA1 are considered to be weak

 

Issue Links

• links to: GitHub Pull Request #9
• links to: GitHub Pull Request #152
• links to: GitHub Pull Request #159
• links to: GitHub Pull Request #160