You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by Davanum Srinivas <di...@yahoo.com> on 2003/06/30 13:58:08 UTC
xml-encryption Interop?
Axl,
Have you tried the interop samples for xml-encryption?
http://lists.w3.org/Archives/Public/xml-encryption/2002Mar/0008.html
Thanks,
dims
=====
Davanum Srinivas - http://webservices.apache.org/~dims/
__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com
Re: xml-encryption Interop?
Posted by Davanum Srinivas <di...@yahoo.com>.
Berin,
<non-binding-request>PLEASE go ahead and fix this....</non-binding-request>. Am trying to do an
interop with .NET and this is a huge show stopper. I will be able to verify the fix.
Thanks,
dims
--- Berin Lautenbach <be...@ozemail.com.au> wrote:
> Axl,
>
> Had a bit of a look at this. Thought it would be a good way to get
> across the spec before looking at the C++ code. Took the
> encrypt-content-tripledes-cbc.xml sample and ran it through. Took me a
> bit of time, and have listed the issues I had to work around in
> XMLCipher below.
>
> I'm happy to do some more permanent fixes to the Java code to get this
> working if people are comfortable trusting a C++ person, but let me know
> if you would prefer to do the updates :>.
>
> Issues :
>
> 1. Sun Base64 decode doesn't work properly. Didn't check to see if
> there were parameters that needed to be set etc. just used the
> org.apache.xml.security.base64 (from memory) class which did the trick.
>
> 2. IVs are not being set. The first 64 bits of the encrypted content
> (for DESede) are the IV. So had to read this out of the encryptedBytes
> and then copy the rest of the byte array into another holder to pass
> into the Cipher.
>
> This makes some interesting issues, as it means that you cannot set the
> Key to the cipher during initialisation of the XMLCipher. Had to take a
> copy of the key, store in a private variable and then initialise the
> Cipher once I had the encrypted text so that I could appropriately set
> the IV AlgorithmParameter during Cipher.init().
>
> This is also interesting because currently decryptElement (and the
> others) have no knowledge of the Cipher algorithm. However you need to
> know the algorithm when you get the decrypted text so you can extract
> the appropriate amount of IV prior to decryption.
>
> 3. Padding is not being done according to the XML Encryption spec. Had
> to re-set the DESede spec to DESede/CBC/NoPad and then manually dePad -
> so created some new methods in XMLCipher to do this work.
>
> 4. The de-serialisation passes back only the first element. So I had
> to modify the Serialiser.deserialise() method to pass back a
> DocumentFragment that contains each of the children that were encrypted.
> The replace node piece is then done with this fragment which adds all
> the required children in at once.
>
> Cheers,
> Berin
>
>
> Axl Mattheus wrote:
> > Dims,
> >
> > When I looked at the link, I saw that I have already downloaded the
> > interop samples. Did not look at it yet. Still struggling to make ends
> > meet with my time. ALL - that is your queue to volunteer help!
> >
> > ax/
> >
> > Davanum Srinivas wrote:
> >
> >> Axl,
> >>
> >> Have you tried the interop samples for xml-encryption?
> >> http://lists.w3.org/Archives/Public/xml-encryption/2002Mar/0008.html
> >>
> >> Thanks,
> >> dims
> >>
> >> =====
> >> Davanum Srinivas - http://webservices.apache.org/~dims/
> >>
> >> __________________________________
> >> Do you Yahoo!?
> >> SBC Yahoo! DSL - Now only $29.95 per month!
> >> http://sbc.yahoo.com
> >>
> >>
> >>
> >
> >
> >
>
=====
Davanum Srinivas - http://webservices.apache.org/~dims/
__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com
Re: xml-encryption Interop?
Posted by Berin Lautenbach <be...@ozemail.com.au>.
Axl,
Had a bit of a look at this. Thought it would be a good way to get
across the spec before looking at the C++ code. Took the
encrypt-content-tripledes-cbc.xml sample and ran it through. Took me a
bit of time, and have listed the issues I had to work around in
XMLCipher below.
I'm happy to do some more permanent fixes to the Java code to get this
working if people are comfortable trusting a C++ person, but let me know
if you would prefer to do the updates :>.
Issues :
1. Sun Base64 decode doesn't work properly. Didn't check to see if
there were parameters that needed to be set etc. just used the
org.apache.xml.security.base64 (from memory) class which did the trick.
2. IVs are not being set. The first 64 bits of the encrypted content
(for DESede) are the IV. So had to read this out of the encryptedBytes
and then copy the rest of the byte array into another holder to pass
into the Cipher.
This makes some interesting issues, as it means that you cannot set the
Key to the cipher during initialisation of the XMLCipher. Had to take a
copy of the key, store in a private variable and then initialise the
Cipher once I had the encrypted text so that I could appropriately set
the IV AlgorithmParameter during Cipher.init().
This is also interesting because currently decryptElement (and the
others) have no knowledge of the Cipher algorithm. However you need to
know the algorithm when you get the decrypted text so you can extract
the appropriate amount of IV prior to decryption.
3. Padding is not being done according to the XML Encryption spec. Had
to re-set the DESede spec to DESede/CBC/NoPad and then manually dePad -
so created some new methods in XMLCipher to do this work.
4. The de-serialisation passes back only the first element. So I had
to modify the Serialiser.deserialise() method to pass back a
DocumentFragment that contains each of the children that were encrypted.
The replace node piece is then done with this fragment which adds all
the required children in at once.
Cheers,
Berin
Axl Mattheus wrote:
> Dims,
>
> When I looked at the link, I saw that I have already downloaded the
> interop samples. Did not look at it yet. Still struggling to make ends
> meet with my time. ALL - that is your queue to volunteer help!
>
> ax/
>
> Davanum Srinivas wrote:
>
>> Axl,
>>
>> Have you tried the interop samples for xml-encryption?
>> http://lists.w3.org/Archives/Public/xml-encryption/2002Mar/0008.html
>>
>> Thanks,
>> dims
>>
>> =====
>> Davanum Srinivas - http://webservices.apache.org/~dims/
>>
>> __________________________________
>> Do you Yahoo!?
>> SBC Yahoo! DSL - Now only $29.95 per month!
>> http://sbc.yahoo.com
>>
>>
>>
>
>
>
Re: xml-encryption Interop?
Posted by Axl Mattheus <ax...@sun.com>.
Dims,
When I looked at the link, I saw that I have already downloaded the
interop samples. Did not look at it yet. Still struggling to make ends
meet with my time. ALL - that is your queue to volunteer help!
ax/
Davanum Srinivas wrote:
>Axl,
>
>Have you tried the interop samples for xml-encryption?
>http://lists.w3.org/Archives/Public/xml-encryption/2002Mar/0008.html
>
>Thanks,
>dims
>
>=====
>Davanum Srinivas - http://webservices.apache.org/~dims/
>
>__________________________________
>Do you Yahoo!?
>SBC Yahoo! DSL - Now only $29.95 per month!
>http://sbc.yahoo.com
>
>
>
Re: xml-encryption Interop?
Posted by Axl Mattheus <ax...@sun.com>.
Dims,
Easy one :-) ... NO. I'll look into it...
Ax/
Davanum Srinivas wrote:
>Axl,
>
>Have you tried the interop samples for xml-encryption?
>http://lists.w3.org/Archives/Public/xml-encryption/2002Mar/0008.html
>
>Thanks,
>dims
>
>=====
>Davanum Srinivas - http://webservices.apache.org/~dims/
>
>__________________________________
>Do you Yahoo!?
>SBC Yahoo! DSL - Now only $29.95 per month!
>http://sbc.yahoo.com
>
>
>