You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by Davanum Srinivas <di...@yahoo.com> on 2004/03/02 20:56:56 UTC

config.xml / updates with latest algo's in JDK1.5?

Dear SUN folks (Axl/Vishal),

Is the config.xml up-to-date? Can you please update the config.xml with the latest algo's
available in JDK1.5?

thanks,
dims

=====
Davanum Srinivas - http://webservices.apache.org/~dims/

Re: config.xml / updates with latest algo's in JDK1.5?

Posted by Davanum Srinivas <di...@yahoo.com>.
Berin,

Can you please send me your updated config.xml?

thanks,
dims

--- Berin Lautenbach <be...@wingsofhermes.org> wrote:
> >> Actually, because of all the problems with Gump (which is/was ignoring
> >> bouncy castle) I've been doing exactly that.
> >> The problem I'm running into is that the Sun JCE does not support the
> >> relaxed version of PKCS5 padding that the Baltimore encryption interop
> >> examples use.
> >
> > Can you be more specific? As of J2SE 1.5 (currently in beta), Sun's JCE
> > provider supports the  ISO 10126 Padding scheme used by XML Encryption.
> > You need to specify ISO10126Padding as your padding algorithm when
> > requesting a Cipher instance.
> 
> <GRIN>.  Yes I was being imprecise.
> 
> Let me be more specific and give my understanding of where things are!
> 
> ISO 10126 padding (used by XML encryption) is a more relaxed version of
> PKCS5 padding, where the padding bytes (other than the last) do not need
> to reference the padding length.
> That means that if an encryptor uses PKCS5 padding, the decryptor can use
> either PKCS5 or ISO 10126.  However if the encryptor uses ISO10126, PKCS5
> decrypt breaks.
> As Baltimore interops use true ISO 10126 (with random bytes in the padding
> block), they do not decrypt using PKCS5 which is all 1.4 supports.
> I have been using 1.4 JCE because of issues in the Gump builds where BC is
> not being called (for some reason).
> I had not looked at 1.5 as I was trying to fix 1.4, and thus the comment
> above :>.
> Cheers,
> 
> 
> 


=====
Davanum Srinivas - http://webservices.apache.org/~dims/

Re: config.xml / updates with latest algo's in JDK1.5?

Posted by Berin Lautenbach <be...@wingsofhermes.org>.
>> Actually, because of all the problems with Gump (which is/was ignoring
>> bouncy castle) I've been doing exactly that.
>> The problem I'm running into is that the Sun JCE does not support the
>> relaxed version of PKCS5 padding that the Baltimore encryption interop
>> examples use.
>
> Can you be more specific? As of J2SE 1.5 (currently in beta), Sun's JCE
> provider supports the  ISO 10126 Padding scheme used by XML Encryption.
> You need to specify ISO10126Padding as your padding algorithm when
> requesting a Cipher instance.

<GRIN>.  Yes I was being imprecise.

Let me be more specific and give my understanding of where things are!

ISO 10126 padding (used by XML encryption) is a more relaxed version of
PKCS5 padding, where the padding bytes (other than the last) do not need
to reference the padding length.
That means that if an encryptor uses PKCS5 padding, the decryptor can use
either PKCS5 or ISO 10126.  However if the encryptor uses ISO10126, PKCS5
decrypt breaks.
As Baltimore interops use true ISO 10126 (with random bytes in the padding
block), they do not decrypt using PKCS5 which is all 1.4 supports.
I have been using 1.4 JCE because of issues in the Gump builds where BC is
not being called (for some reason).
I had not looked at 1.5 as I was trying to fix 1.4, and thus the comment
above :>.
Cheers,

Re: config.xml / updates with latest algo's in JDK1.5?

Posted by Sean Mullan <Se...@Sun.COM>.
Berin Lautenbach wrote:
> Dims,
> 
> Actually, because of all the problems with Gump (which is/was ignoring
> bouncy castle) I've been doing exactly that.
> The problem I'm running into is that the Sun JCE does not support the
> relaxed version of PKCS5 padding that the Baltimore encryption interop
> examples use.

Can you be more specific? As of J2SE 1.5 (currently in beta), Sun's JCE provider
supports the  ISO 10126 Padding scheme used by XML Encryption. You need to specify
ISO10126Padding as your padding algorithm when requesting a Cipher instance.

Thanks,
Sean

Re: config.xml / updates with latest algo's in JDK1.5?

Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Dims,

Actually, because of all the problems with Gump (which is/was ignoring
bouncy castle) I've been doing exactly that.
The problem I'm running into is that the Sun JCE does not support the
relaxed version of PKCS5 padding that the Baltimore encryption interop
examples use.
Either way, am getting as much in there as possible in preparation for 1.1.

Cheers,
     Berin

> Dear SUN folks (Axl/Vishal),
>
> Is the config.xml up-to-date? Can you please update the config.xml with
> the latest algo's available in JDK1.5?
>
> thanks,
> dims
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/

Re: List of items needed in NativeJCE?

Posted by Berin Lautenbach <be...@wingsofhermes.org>.
Note that ISO10126PADDING is not supported in the 1.4 JCE.  It might be in
1.5, and I will check.
Cheers,
    Berin


> Here's the list of things that needs to be added eventually to
> NativeJCE (needed by xmlenc/xmldsig specs). The name/id's are from
> BouncyCastle provider. PLEASE check if the list is correct/complete.
>
> thanks,
> dims
>
> javax.crypto.Cipher:
>        "DESEDE/CBC/ISO10126PADDING"
>        "AES/CBC/ISO10126PADDING"
>        "RSA/ECB/PKCS1PADDING"
>        "RSA/ECB/OAEPPADDING"
>        "DESEDEWrap"
>        "AESWrap"
>
> java.security.Signature:
>        "DSA",
>        "SHA1WithRSAEncryption"
>
> javax.crypto.Mac:
>        "HMACSHA1"
>
> java.security.MessageDigest:
>        "SHA-1",
>        "SHA-256",
>        "SHA-512",
>        "RIPEMD160"
>
> Thanks,
> dims
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/

Re: List of items needed in NativeJCE?

Posted by Walter Hoehn <wa...@memphis.edu>.
If you are compiling a work list, I see the following items as being of 
a high priority:

1) Add OpenSSL threading locks.
2) Add error handling.
3) Rationalize the test cases and provide performance/threading testing.
4) Add ENGINE support

I should have some time in mid to late april to dedicate to this.

-Walter


On Mar 2, 2004, at 5:16 PM, Davanum Srinivas wrote:

> Here's the list of things that needs to be added eventually to 
> NativeJCE (needed by xmlenc/xmldsig
> specs). The name/id's are from BouncyCastle provider. PLEASE check if 
> the list is
> correct/complete.
>
> thanks,
> dims
>
> javax.crypto.Cipher:
>         "DESEDE/CBC/ISO10126PADDING"
>         "AES/CBC/ISO10126PADDING"
>         "RSA/ECB/PKCS1PADDING"
>         "RSA/ECB/OAEPPADDING"
>         "DESEDEWrap"
>         "AESWrap"
>
> java.security.Signature:
>         "DSA",
>         "SHA1WithRSAEncryption"
>
> javax.crypto.Mac:
>         "HMACSHA1"
>
> java.security.MessageDigest:
>         "SHA-1",
>         "SHA-256",
>         "SHA-512",
>         "RIPEMD160"
>
> Thanks,
> dims
>
> =====
> Davanum Srinivas - http://webservices.apache.org/~dims/

List of items needed in NativeJCE?

Posted by Davanum Srinivas <di...@yahoo.com>.
Here's the list of things that needs to be added eventually to NativeJCE (needed by xmlenc/xmldsig
specs). The name/id's are from BouncyCastle provider. PLEASE check if the list is
correct/complete.

thanks,
dims

javax.crypto.Cipher:
        "DESEDE/CBC/ISO10126PADDING"
        "AES/CBC/ISO10126PADDING"   
        "RSA/ECB/PKCS1PADDING"      
        "RSA/ECB/OAEPPADDING"
        "DESEDEWrap"                
        "AESWrap"

java.security.Signature:
        "DSA",                       
        "SHA1WithRSAEncryption"     

javax.crypto.Mac:
        "HMACSHA1"

java.security.MessageDigest:
        "SHA-1",                     
        "SHA-256",                   
        "SHA-512",                   
        "RIPEMD160"                 

Thanks,
dims

=====
Davanum Srinivas - http://webservices.apache.org/~dims/