What is XML Encryption

1
What is XML Encryption
A W3C Standard Recomendation, http//www.w3c.org/E
ncryption/2001/ A process for encrypting data and
representing the result in XML This data can be
arbitrary data, including XML documents,
individual elements, or content. Uses symmetric
cipher for data protection (DESede, AES) Uses RSA
for key protection
2
Examples
Element

• lt?xml version'1.0'?gt
• ltPaymentInfo xmlns'http//example.org/paymentv2
  'gt
• ltNamegtJohn Smithlt/Namegt
• ltCreditCard Limit'5,000' Currency'USD'gt
• ltNumbergt4019 2445 0277 5567lt/Numbergt
• ltIssuergtExample Banklt/Issuergt
• ltExpirationgt04/02lt/Expirationgt
• lt/CreditCardgt
• lt/PaymentInfogt

lt?xml version'1.0'?gt ltPaymentInfo
xmlns'http//example.org/paymentv2'gt
ltNamegtJohn Smithlt/Namegt ltEncryptedData
Type'http//www.w3.org/2001/04/xmlencElement'
xmlns'http//www.w3.org/2001/04/xmlenc'gt
ltCipherDatagt ltCipherValuegtA23B45C56A23B4
5C56lt/CipherValuegt lt/CipherDatagt
lt/EncryptedDatagt lt/PaymentInfogt
3
Examples
Element content
lt?xml version'1.0'?gt ltPaymentInfo
xmlns'http//example.org/paymentv2'gt
ltNamegtJohn Smithlt/Namegt ltCreditCard
Limit'5,000' Currency'USD'gt ltNumbergt4019
2445 0277 5567lt/Numbergt ltIssuergtExample
Banklt/Issuergt ltExpirationgt04/02lt/Expirationgt
lt/CreditCardgt lt/PaymentInfogt
lt?xml version'1.0'?gt ltPaymentInfo
xmlns'http//example.org/paymentv2'gt
ltNamegtJohn Smithlt/Namegt ltCreditCard
Limit'5,000' Currency'USD'gt
ltEncryptedData xmlns'http//www.w3.org/2001/04/xm
lenc' Type'http//www.w3.org/2001/04/xmle
ncContent'gt ltCipherDatagt
ltCipherValuegtA23B45C56lt/CipherValuegt
lt/CipherDatagt lt/EncryptedDatagt
lt/CreditCardgt lt/PaymentInfogt
4
Examples
cdata content
lt?xml version'1.0'?gt ltPaymentInfo
xmlns'http//example.org/paymentv2'gt
ltNamegtJohn Smithlt/Namegt ltCreditCard
Limit'5,000' Currency'USD'gt ltNumbergt4019
2445 0277 5567lt/Numbergt ltIssuergtExample
Banklt/Issuergt ltExpirationgt04/02lt/Expirationgt
lt/CreditCardgt lt/PaymentInfogt
lt?xml version'1.0'?gt ltPaymentInfo
xmlns'http//example.org/paymentv2'gt
ltNamegtJohn Smithlt/Namegt ltCreditCard
Limit'5,000' Currency'USD'gt ltNumbergt
ltEncryptedData xmlns'http//www.w3.org/2001/04
/xmlenc' Type'http//www.w3.org/2001/04
/xmlencContent'gt ltCipherDatagt
ltCipherValuegtA23B45C56lt/CipherValuegt
lt/CipherDatagt lt/EncryptedDatagt
lt/Numbergt ltIssuergtExample Banklt/Issuergt
ltExpirationgt04/02lt/Expirationgt
lt/CreditCardgt lt/PaymentInfogt
5
Products and solutions
Commercial Java products

• KeyTools XML, Baltimore Technologies
• XML Signature XML Encryption
• much, much more
• XML Security Suite, IBM Corp.
• XML Signature XML Encryption
• XML Access Control Language
• Phaos XML Security Suite, Phaos Tech.
• XML Signature XML Encryption
• SAML

6
Products and solutions
Open Source
XML Security Library, MIT http//www.aleksey.com
/xmlsec/ XML Signature XML Encryption C
Library using OpenSSL XML Security, Apache XML
Project. http//xml.apache.org/security/ XML
Signature Partly XML Encryption (beta) Java
7
Products and solutions
Our solution
XML Encryption Using Sun JCE and JCA Using JDOM
as XML DOM toolkit Implements most required
features of the W3C Recommendation Keys protected
with password protected encryption standard (PKCS
5) Does not support encrypted key feature, user
must have the correct key.
8
Overview
JCE
KeyManager
XMLEncryptionDemo
XMLSecurityEngine
XMLSignatureEngine
XMLEncryptionEngine
XMLHandler
XMLEncryption
EncryptedData
JCE
9
Code Examples
Our solution
Encryption of an xml element XMLEncryption
encrypter new XMLEncryption(plaintextElement) e
ncrypter.encrypt(key) XMLHandler.replaceElement(p
laintextElement, encrypter.getElement())
Encryption of element content XMLEncryption
encrypter new XMLEncryption(plaintextElement.ge
tContent()) encrypter.encrypt(key) XMLHandler.re
placeContent(plaintextElement, encrypter.getEl
ement())
10
Code Examples
Our solution
Decryption of an EncryptedData element XMLEncrypt
ion decrypter new XMLEncryption(encryptedDataEl
ement) decrypter.decrypt(key) List content
decrypter.getContent() Element element
decrypter.getElement() if (content ! null)
XMLHandler.replaceContent(encryptedDataEle
ment.getParent(), content) else if
(element ! null) XMLHandler.replaceElement
(encryptedDataElement, element)