Dominik Schadow

Category: XML Security

XML Encryption 1.1 is a candidate recommendation

The XML Security Working Group has published the Candidate Recommendation for XML Encryption Syntax and Processing 1.1. The most important update in this version addresses the lately published chosen-ciphertext attacks against the CBC class of algorithms. Besides that, AES 128-GCM is now a required algorithm. AES-GCM is an authenticated encryption algorithm and provides both authentication and privacy. RSA-OAEP, a key transport algorithm, offers more algorithm variants. The other updates were more or less polishing for the final recommendation.

The other updated recommendation is XML Encryption 1.1 CipherReference Processing using 2.0 Transforms, now a candidate recommendation too. This rather short document (for a W3C recommendation!) specifies how the XML Signature 2.0 transform model may be used with XML Encryption 1.1 for CipherReference processing.

March 14, 2012
Apache XML Security 1.5.1 available

One month after the 1.5.0 release, the bugfix release 1.5.1 of Apache Santuario is available. Two bugs were fixed: one in XMLSignatureInput when using a BufferedInputStream. The other one caused Santuario to still require Apache Xalan (which was changed to optional in 1.5.0). Besides that, encryption and decryption should work faster now.

February 25, 2012
Apache XML Security 1.5.0 released

Apache Santuario 1.5.0 has been released. As the release notes point out, this release is not binary compatible with Santuario 1.4 any more.

There are some really good updates included, of which I like that Xalan/Xerces are not required dependencies any more the most. Under the covers, support for Java 1.4 was dropped, and generics are used where possible.

The binary incompatibility will require some changes and tests until this version will be available with the JCrypTool XML Security plug-in.

January 28, 2012
XML Security Working Group announced last calls for XML Encryption working drafts

The XML Security working group published the last calls for two XML Encryption working drafts: XML Encryption 1.1 contains, besides some other updates, AES-128-GCM, a new mandatory algorithm to implement which addresses the lately published security problems (catastrophe?!) with XML Encryption. This part alone justifies a closer look at the candidate recommendation.

The other last call is about XML Encryption 1.1 CipherReference Processing using 2.0 Transforms. This recommendation makes the usage of CipherReference transform processing easier with XML Encryption (as defined in the XML Security 2.0 spec).

Besides that, test cases for XML Encryption 1.1 and Canonical XML 2.0 have been updated as well. And of course the XML Security Algorithm Cross-Reference which reflects the latest changes to the XML Encryption recommendation.

January 6, 2012
Apache Santuario 1.4.6 available

A new maintenance release (1.4.6) of Apache Santuario, the Apache XML Security project, is available. The release notes are a little bit confusing. Looks like five bugs were fixed. The new version will be available in the next JCrypTool release.

October 27, 2011
Unsafe XML Encryption?!

This analysis (in German, English version is available here) by the well-known Ruhr University Bochum puts XML Encryption into some real trouble. Since there is no solution or workaround, the only possibility is to accept the drawbacks and to use SSL to secure any Web Service communication. Back to good old transportation based security.

October 20, 2011
XML Security tutorials now on GitHub

The German XML Security tutorials are now developed on GitHub. This does not affect the Eclipse XML Security Tools at all; the German tutorials will never be integrated there. The sources are only used to generate the tutorials available on my home page.

I'm working on some content updates. As soon as this will be finished I'll provide a new html version.

July 3, 2011
Apache XML Security version 1.4.4 available

Already out there for quite a while now: Apache XML Security (Santuario) in version 1.4.4. This is a maintenance release, see the release notes here.

December 11, 2010
Versions 1.1 of XML Security coming closer

The W3C recently published new working drafts of several XML Security related 1.1 versions: On May 13th, XML Signature Syntax and Processing, XML Encryption Syntax and Processing and XML Security Generic Hybrid Ciphers have been updated. These are so called Last Call Working Drafts, meaning the process is finally coming to an end and we should see the final recommendations within the next (couple of) months (in case there are no major updates required).

May 19, 2010
Different XML Security drafts updated

Quite a lot of XML Security related drafts were updated during my two months holiday:

XML Signature Syntax and Processing Version 2.0 and Canonical XML Version 2.0 both got updated on March 4th 2010. However both documents are still in working draft stage.

Besides that there is a new XML Encryption Syntax and Processing Version 1.1 from March 16th 2010. This is a working draft too. The XML Security RELAX NG Schemas working draft reflects the latest changes on the RELAX NG schema side.

The likewise updated XML Security Generic Hybrid Ciphers working draft talks about a consistent treatment of asymmetric ciphers when encrypting data. The focus lies on interoperability, which on one side is a nice working draft but comes with the price of another namespace declaration and some new elements for the already complex XML Security recommendations…

And finally there is an update on the XML Security Algorithm Cross-Reference working draft which reflects all updates applied to XML Signature and XML Encryption working drafts (and recommendations) up to version 1.1 (the different working drafts for version 2.0 are not included in this one).

March 29, 2010