Skip to content

Commit 48713f6

Browse files
timleggetimlegge
committed
Add support for specifying xenc:OAEPparams
1 parent a64c613 commit 48713f6

File tree

3 files changed

+196
-2
lines changed

3 files changed

+196
-2
lines changed

‎lib/XML/Enc.pm‎

Lines changed: 49 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,24 @@ Used in encryption. Optional. Default method: rsa-1_5
147147
148148
=back
149149
150+
=item B<oaep_method>
151+
152+
Specify the Algorithm to be used for rsa-oaep. Supported methods are:
153+
154+
=over
155+
156+
=item * L<mgf1sha1|http://www.w3.org/2009/xmlenc11#mgf1sha1>
157+
158+
=item * L<mgf1sha224|http://www.w3.org/2009/xmlenc11#mgf1sha224>
159+
160+
=item * L<mgf1sha265|http://www.w3.org/2009/xmlenc11#mgf1sha256>
161+
162+
=item * L<mgf1sha384|http://www.w3.org/2009/xmlenc11#mgf1sha384>
163+
164+
=item * L<mgf1sha512|http://www.w3.org/2009/xmlenc11#mgf1sha512>
165+
166+
=back
167+
150168
=back
151169
152170
=cut
@@ -179,6 +197,8 @@ sub new {
179197
my $oaep_method = exists($params->{'oaep_method'}) ? $params->{'oaep_method'} : 'http://www.w3.org/2009/xmlenc11#mgf1sha1';
180198
$self->{'oaep_method'} = $self->_setOAEPAlgorithm($oaep_method);
181199

200+
$self->{'oaep_params'} = exists($params->{'oaep_params'}) ? $params->{'oaep_params'} : '';
201+
182202
return $self;
183203
}
184204

@@ -297,6 +317,11 @@ sub encrypt {
297317
my $base64_key = encode_base64($key);
298318
my $base64_data = encode_base64($encrypteddata);
299319

320+
# Insert OAEPparams into the XML
321+
if ($self->{oaep_params} ne '') {
322+
$encrypted = $self->_setOAEPparams($encrypted, $xpc, encode_base64($self->{oaep_params}));
323+
}
324+
300325
# Insert Encrypted data into XML
301326
$encrypted = $self->_setEncryptedData($encrypted, $xpc, $base64_data);
302327

@@ -339,6 +364,19 @@ sub _setEncryptionMethod {
339364
return exists($methods{$method}) ? $methods{$method} : $methods{'aes256-cbc'};
340365
}
341366

367+
sub _setOAEPparams {
368+
my $self = shift;
369+
my $context = shift;
370+
my $xpc = shift;
371+
my $oaep_params = shift;
372+
373+
my $node = $xpc->findnodes('//xenc:EncryptedKey/xenc:EncryptionMethod/xenc:OAEPparams', $context);
374+
375+
$node->[0]->removeChildNodes();
376+
$node->[0]->appendText($oaep_params);
377+
return $context;
378+
}
379+
342380
sub _setOAEPAlgorithm {
343381
my $self = shift;
344382
my $method = shift;
@@ -517,10 +555,10 @@ sub _EncryptKey {
517555
${$key} = $rsa_pub->encrypt(${$key}, 'v1.5');
518556
}
519557
elsif ($keymethod eq 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p') {
520-
${$key} = $rsa_pub->encrypt(${$key}, 'oaep', 'SHA1');
558+
${$key} = $rsa_pub->encrypt(${$key}, 'oaep', 'SHA1', $self->{oaep_params});
521559
}
522560
elsif ($keymethod eq 'http://www.w3.org/2009/xmlenc11#rsa-oaep') {
523-
${$key} = $rsa_pub->encrypt(${$key}, 'oaep', $self->_getOAEPAlgorithm($self->{oaep_method}));
561+
${$key} = $rsa_pub->encrypt(${$key}, 'oaep', $self->_getOAEPAlgorithm($self->{oaep_method}), $self->{oaep_params});
524562
} else {
525563
die "Unsupported Key Encryption Method";
526564
}
@@ -865,6 +903,15 @@ sub _create_encrypted_data_xml {
865903
}
866904
);
867905

906+
if ($self->{'oaep_params'} ne '') {
907+
my $oaep_params = $self->_create_node(
908+
$doc,
909+
$xencns,
910+
$kencmethod,
911+
'xenc:OAEPparams',
912+
);
913+
};
914+
868915
if ($self->{key_transport} eq 'http://www.w3.org/2009/xmlenc11#rsa-oaep') {
869916
my $oaepmethod = $self->_create_node(
870917
$doc,

‎t/08-support-oaepparams.t‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
use strict;
2+
use warnings;
3+
use Test::More tests => 5;
4+
use XML::Enc;
5+
use MIME::Base64 qw/decode_base64/;
6+
use File::Which;
7+
use File::Slurper qw/read_text/;
8+
9+
my $xml = <<'ENDXML';
10+
<?xml version="1.0" encoding="UTF-8"?>
11+
<PaymentInfo xmlns="http://example.org/paymentv2">
12+
<Name>John Smith</Name>
13+
<CreditCard Currency="USD" Limit="5,000"><EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Id="ED" Type="http://www.w3.org/2001/04/xmlenc#Content">
14+
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
15+
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
16+
<EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#" Id="EK">
17+
<EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
18+
<ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
19+
<OAEPparams>MTIzNDU2Nzg=</OAEPparams>
20+
</EncryptionMethod>
21+
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
22+
<ds:KeyName>my-rsa-key</ds:KeyName>
23+
</ds:KeyInfo>
24+
<CipherData>
25+
<CipherValue>qkGLaEkRFs+wAbz/zXl50nI7w8+b0NUxYXQu84lJz4iXeKj5/si2lgADR9bGVQ6N
26+
iSQGxMF9cra8zlzaB6hqxcL3u4A161ajA4iMn88kdkda/ZgVANaombU1HPn+Mqzo
27+
3/F/hfGSJ0CpzXv5Pi3zqe2J3Sii9NQBiyRkd0lbm41gCXLuRNkZH9x/LhOlrHEC
28+
Vj/7fi8sYTFuqz4MeCbIdNOzxOR5g/L+VTeAcTZfT6wfkfc7jFa2CqkwBqMvNrtD
29+
o+A0MmK0fb0/kJLxNx91PVXNti4l/SrbmGZhKIIgmY9DKtAJjTK60zWkiamfqA/N
30+
WbrcIZjGje5oRXC7GLyBJfHuLo4sQIN7UvbZCcz16OVcgOC2B/hG7CQCXGwiZV+U
31+
rTLjBaijbx/j0+zbMs+PkmD2Ba3DgrwzsGJ2sPq6oTW28ZJebcjSxNEundodNuFv
32+
RcohqiMFOlVJRKU/x15HsthnXrMDvYpIrKT4NJKQJHnPEeTZ+Bd6PR8jTL30p2Ea
33+
6yH3F189AVgQf8t6ZB+GSBb/zO2aKIrA6iiViz+MJDiiD3XY3T3beaDH/u09izRs
34+
bBqDCnFkkxajyENT8r5C1tS0PNAmaisXqPhkYSsWUBHYPgIxUasDy2oJBafF1JW0
35+
02N7Bvg9oVFDY+Xc4hWsmaC31txPEds6ZdxhBclCMu0=</CipherValue>
36+
</CipherData>
37+
</EncryptedKey>
38+
</ds:KeyInfo>
39+
<CipherData>
40+
<CipherValue>ecIQfyygbLDMHLKCLO31g3Y4Q+2eJZ15hyt/kiLekdBWHZRFUBzEf/3W5H66tCL2
41+
/fsWY+Y2Zim64WuXJfPdYmy4UtSexpwTEHr0I5LR6Ykw2A61akDEh/zXKWpHsLrn
42+
so/amlIwRtEYJTQdER7+6kkMa40M2Jf2Hk6BIXfOSCggh0KpnCnuc1+NACE0VUh6</CipherValue>
43+
</CipherData>
44+
</EncryptedData></CreditCard>
45+
</PaymentInfo>
46+
ENDXML
47+
48+
my $decrypter = XML::Enc->new(
49+
{
50+
key => 't/xmlsec-key.pem',
51+
no_xml_declaration => 1
52+
}
53+
);
54+
55+
ok($decrypter->decrypt($xml) =~ /4019 2445 0277 5567/, "Successfully Decrypted xmlsec1 xml using OAEPparams");
56+
57+
$xml = <<'XML';
58+
<?xml version="1.0"?>
59+
<foo ID="XML-SIG_1">
60+
<bar>123</bar>
61+
</foo>
62+
XML
63+
64+
my $encrypter = XML::Enc->new(
65+
{
66+
key => 't/sign-private.pem',
67+
cert => 't/sign-certonly.pem',
68+
oaep_params => '123456789',
69+
no_xml_declaration => 1
70+
}
71+
);
72+
73+
my $encrypted = $encrypter->encrypt($xml);
74+
ok($encrypted =~ /CipherData/, "Successfully Encrypted with XML::Enc using OAEPparams");
75+
76+
ok($encrypter->decrypt($encrypted) =~ /<bar>123<\/bar>/, "Successfully Decrypted with XML::Enc using OAEPparams");
77+
78+
$decrypter = XML::Enc->new(
79+
{
80+
key => 't/sign-private.pem',
81+
cert => 't/sign-certonly.pem',
82+
oaep_params => '123789',
83+
no_xml_declaration => 1
84+
}
85+
);
86+
$encrypted =~ s/MTIzNDU2Nzg5/MTIzNzg5Cg==/mg;
87+
88+
my $ret;
89+
eval {
90+
$ret = $decrypter->decrypt($encrypted);
91+
};
92+
ok($@ =~ /FATAL: rsa_decrypt_key_ex/,"XML::Enc Unable to decrypt if XML includes incorrect OAEPparams");
93+
ok(!$ret);
94+
95+
done_testing;

‎t/xmlsec-key.pem‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDzYfk2VK5dF2gb
3+
GCgkck45Xb8gF8h8IFn7o0LkLLcNbZd+4Zu6WcPn6GT/djVY4JD6KxOSX7q3f1Ql
4+
bs7NG6N4kjQxf53cgGE8cmltuDWo+B8DbOXXQVMkhIpycDziOYvscJ3Tzy4I9gWA
5+
rzaP7Y7v31AzlFgVj4fEtGU9odEjAGpnNWAGWL1DioZSKfSh4V9/WW7KSngWndoE
6+
2WHUo+ppcn8bqv/IB1ETUME+fZv3cNy6XZSpK6zqVuA8f12R772CJfI36yzZrbfd
7+
PryGeq+Jj/kyXpzQQQyMt4ReKelP/LVc9PmCMrk17YQKMiMytaSxyMWgFrV3jSGP
8+
U4DEoaRl7q8KhB00MOMHNc4Wjml7tyGRVibC1z95DuCyd6XKYIgVMI9lqo+dn9BQ
9+
PSqbT2HKQxm5aVgbmHdDQh4IfDBYUtSz69GinijdG5b9+Sj9dtjskSHRjUJM9QVw
10+
LtK7msXI4XddTl/Cq5/AdVERbuprDtS8k96klePSUlesdMWm5aKUP9hDDkKMda0M
11+
adGojudJdys4r8msQ3cnkIIdYuYxoBsXvn5jLCnsGz1LUjnseir8SC+9ztkfIQL7
12+
LG7ZQBTFas4gvAzkroc10tpf25VQ8+PtLJOtQluvZf74SwrcYH/dSDiI0Pykqvxf
13+
B5fPrrdDPYfrvlHj8YwfY0MpJIyUIwIDAQABAoICAEeS02An7RMRVBtLslpthxWV
14+
vSQp+lqOhQfcjkpd4ANB7GBy5oIZ7ePgUvtRfwTBHcGEM4BDSLy35D4R5R0qeJt3
15+
m4PG/NygoHfPSbPrjVRAi5ZNSxZPbqz5kWFwImeA9uY0hCWK8wXNm/apEEmpWfSu
16+
3n4crP7CM/Ij/vXuBXvenmv1pWSYaihXr4KwNfH5PkVMPqmc1s4H49qzNvL6tXAH
17+
LNwtIIVpqW0dvYasF9bfyPnBlXtejb5oiA8igZjuQPPqRt4s+gaV8NFOptCBeefh
18+
gC5Q5prT1mX3fiTW/Hb6YTeSD2I7mn4CeGcrMXCzPFjQK1YV943N4kWtD9xDkP2a
19+
JwxpNUH3PKLNquRcaAc6idy4hUFWBXyLuABjHFxHaOwOHJKhRdwgwVbHExVHrp3H
20+
6ArgVQH8Y5fbo0xy+PQWCNCRRYKgMqK9RKL0KWAfb+vxsVL6c0Sha4nbcupQ7Yu0
21+
YMXXPY9dKzxJVR3ZI9MeOWcnqdIVuu2t+TAYxSi/9CLMifsYfQgZQkJTlFmrdVSz
22+
lJ0mqvsaXPzKOdsVpxN9Ktd1suMPu2gU4Ty004msAojuYGEf0uydDgTRFGOlf/oa
23+
jNU7rF940VYqzHihxnRPvBGNLBvo+L+VV/n1VnBeAjrswkDw/HowgZQOQ846jref
24+
X9mzhhjc+XuooA4avz3xAoIBAQD/UHw76qKBdtNxcIASSZCKaFAOWvKUG6e5xZMo
25+
8s0Ut3WqIDACXH2QNUcfQZX+XGoQqH1ubTTo46oekRjA6gcVZ9evSFfj4Urzp8jx
26+
IJnxM9sxZiTHvnrvIDCX2njia/fAdvC5UKwSjJBLkQoJ9w4v+ksXs7IMwxZoc0vH
27+
bgL6DstGmKb83JQ9CNPGZEFfit37ioUEgofUqxqf7uub/LNjdVkK3AvOopCe2w4+
28+
t1g7S89imrmWJ4iNKzPa/u4Vr5CAdVpq6lRRgQre2kQp8tL6Is0DVoSaaVV+QVze
29+
pZ5HvLxIU31N50FUsaDqDCNnWR/lijhl+B8VT/Rea4vSD8mbAoIBAQD0CUkrBQG0
30+
wR5q4hjTSA0J1BU3WjGwKvFryScMwNaX0Q4oSmgDqKV6lE6zOXGPt6N0UHEeqcjS
31+
HhTrIuKawMH4s4DxQu8iFNg5ZXYUgD/Ol/B6Pfh1ycDhCIzsKzrfPqvzhzclL4RU
32+
vXfNmg0F2ZPOwsgTLjtKq/xc/VXMjbiZn60tTotdfnSSPiKJs+sWB9iQDXOx+H9q
33+
ZjWEFeS0CPi284wj2y6DLenLWI+Wm75RfdbudtTMjrptm0OC4uzNBaRZ8zDCQcAF
34+
ByM757p8opV70/8p0IfdxfPdhMrdkr18hYmMhIXKZLzB32jvSIj0dP7T93hMR3yW
35+
Y6mrVUKrZewZAoIBADQW/LHQxkT5tFwRot+YSLgkXij/nzxehBLf341cNEFEyOnj
36+
1Ue2DRwt8ovK+spBmpY5ehXcjA3z3RKNcepyFO3mGNg3P09L+NnLYrDngOD4PoFO
37+
oLRsBXLiM2fX+A/iDVMkMSrt7Z1/NjVkqxKraCabv1RfojT+XIUE+PIAXPUdrZWC
38+
sZcnfcsSEPsKG1hd4bpfYZIw+3uFSVJWEZXqscLZ/0e662HGQxFWCgr7pzG53t70
39+
SGb9O9vpc5P7rSGZhzbeOotTsc5LMKeVCpEwbKECFqfWsAk88mdm+IaobamfNR7g
40+
gdEyHF8mOnll7pc4VMylLaqIO/dCL85PzOAXvn8CggEABFtOFRiHyURRWLMkolD8
41+
+pnwrwZLMMvzd2sl6VJgAmHXEN0TMk2GdsPDC+wQnPI4VtFA071QOoAS+4ep5/1c
42+
+SWrPaNmRYN9wLiQ/Ri1Cuknf+cvUlsBuILAkU7MREQIKdbWIzHP+PtQ8ji31szl
43+
mKFdlQoUQOcFIFvddkNpckSpgM+QKWEij6HQWAkAP2pwcVHsKNc43xtoBS2m4Zfv
44+
aMS8Ub+N+wWM0PaJybSKF0ZZ2fQBJI2/wkktUV7fv2FEZ96xliY6WVyhQmaGq8bz
45+
SDymp4ZzhoAMNH40aPQ/scNoizuqb8yQmh108CCpYUPdcMdQPHxiOwUYeFiTUiAF
46+
sQKCAQEA6x798jTopyhDcBEdRX3xSxMF/gJ4vJ2UCR2jImQn50ioWapEuY3M6iV/
47+
N8QmSn5g719TopTn6YXY9TEZxTpCFQ6TYvMMXkBEV5lI1npSasV2bdAaQEcTu76J
48+
EGMeGtHzQ+MTSpgztWOqD0vWTiGv3txyuP201FISo+1HtcDpB8DHdEGUl9BcCbAt
49+
5K4YLpKHRDnlRiEd6A3YhuUVxh2jFivry4OkynKl1yBsKUoFrEIi9wq9s+LOIewB
50+
TZVmcuYI4DroKyq/RPD8iNSimzkR6AgnotPb1CxeB2/cT9ZvrJAX29LQtFYGMTLf
51+
8VHBrGzppyqyV8FPdApAxKMMANMIqg==
52+
-----END PRIVATE KEY-----

0 commit comments

Comments
 (0)