10/5/2010

XML ENCRYPTION

SeminarsTopics.com

XML ECRYPTION
Definition of xml encryption.
XML Encryption provides end-to-end security for applications that require secure exchange of structured data. XML itself is the most popular technology for structuring data, and therefore XML-based encryption is the natural way to handle complex requirements for security in data interchange applications.

Reason be in! its !e"elopment.

Currently, Transport Layer ecurity !TL " is the de facto standard for secure communication over the #nternet. TL is an end-to-end security protocol that follo$s the famous ecure oc%et Layer ! L". L $as originally designed &y 'etscape, and its version (.) $as later adapted &y the #nternet Engineering Tas% *orce !#ET*" $hile they $ere designing TL . This is a very secure and relia&le protocol that provides end-to-end security sessions &et$een t$o parties. XML Encryption is not intended to replace or supersede L+TL . ,ather, it provides a mechanism for security requirements that are not covered &y L. The follo$ing are t$o important areas not addressed &y L

Encrypting part of the data &eing exchanged ecure sessions &et$een more than t$o parties

.ith XML Encryption, each party can maintain secure or insecure states $ith any of the communicating parties. /oth secure and non-secure data can &e exchanged in the same document. *or example, thin% of a secure chat application containing a num&er of chat rooms $ith several people in each room. XML-encrypted files can &e exchanged &et$een chatting partners so that data intended for one room $ill not &e visi&le to other rooms.

#rief !escription.
There are three procedures to XML Encryption. 1. SYMMETRIC ENCRYPTION Only one session ey is used and it!s the same ey that encrypts the xml which is used to decrypt it. The %ey is not stored $ith the encrypted xml and so the %ey needs to &e loaded during the process and protected $hen stored. 2. COMBINATION OF ASYMMETRIC AND SYMMETRIC ENCRYPTION The dual approach requires a symmetric session %ey to encrypt the data and an asymmetric %ey to protect the session %ey. /oth the encrypted session %ey and the encrypted data are stored together in the xml document. The pu&lic asymmetric %ey is used to encrypt the session %ey $hile the private asymmetric %ey is used to decrypt the %ey.

SeminarsTopics.com 3. X.509 CERTIFICATE. This approach uses a X.0)1 certificate as the symmetrical %ey. X.0)1 certificates are provided &y a third party vendor such as 2eri ign. $pproac es Xml encryption, regardless of ho$ the encryption is performed, can store the encrypted data in one of t$o $ays.
1. After encryption the <EncryptedData>.

ho!e e!e"ent i# rep!$ce%

ith $n e!e"ent n$"e%

2. After encryption on!y the %$t$ in the e!e"ent i# rep!$ce% $n% it# n$"e

re"$in# re$%$&!e in the %oc'"ent. The difference is very su&tle &ut it3s rather important. *or example4our xml document contains a root element called <employee> that contains a child element called <WrittenWarning> in $hich details of disciplinary action is stored. #f you $ere sending this xml and $anted the <WrittenWarning> elements details protected $ith approach 5 the <WrittenWarning> is replaced $ith an element called <EncryptedData> and no information can &e gathered from the document. .ith approach 6 ho$ever the <WrittenWarning> element stays and only the data is encrypted. 7nyone $ho intercepted this document might not %no$ the specific details of the discipline action &ut they $ill still %no$ that something has happened $ith that employee. 7ny attri&utes on the <WrittenWarning> element are also not encrypted. o the approach you ta%e depends on $hat the data is and ho$ much information you $ant to give a$ay. #n .'ET v6.) deciding on $hich approach to ta%e is specified using a /oolean value and can &e easily modified. Example of XML Encryption /elo$ is an example of XML encryption using the asymmetric approach $here the author element in the xml document is replaced $ith an <EncryptedData> element.
The XML Document
01.<?xml version="1.0" standalone="no"?> 02.<article> 03. 0!. 0,. 0-. 0.. <articlein o> <title>"#at$ %&eries on "mlDoc&ment o'(ects in .)E* 1.1<+title> <a'stract> <para>*$is article covers t$e 'asics.<+para> <+a'stract>

SeminarsTopics.com
0/. 00. 10. 11. 12. 13. 1!. <a&t$or> <$onori ic>1r.<+$onori ic> < irstname>2eorge<+ irstname> <s&rname>3ames<+s&rname> <email>g(ames4doman.com<+email> <+a&t$or> <+articlein o>

1,.<+article>

XP$th e(pre##ion ) /$rtic!e/$rtic!einfo/$'thor

The encrypted XML Document

01.<?xml version="1.0" standalone="no"?> 02.<article> 03. 0!. 0,. 0-. 0.. 0/. 00. 10. 11. 12. 13. 1!. 1,. 1-. <articlein o> <title>"#at$ %&eries on "mlDoc&ment o'(ects in .)E* 1.1<+title> <a'stract> <para>*$is article covers t$e 'asics.<+para> <para>*$is article does not cover.<+para> <+a'stract> <EncryptedData *ype="$ttp5++666.63.org+2001+0!+xmlenc7Element" xmlns="$ttp5++666.63.org+2001+0!+xmlenc7"> <Encryption1et$od 8lgorit$m="$ttp5++666.63.org+2001+0!+xmlenc7aes2,-9c'c" +> <:ey;n o xmlns="$ttp5++666.63.org+2000+00+xmldsig7"> <Encrypted:ey xmlns="$ttp5++666.63.org+2001+0!+xmlenc7"> <Encryption1et$od 8lgorit$m="$ttp5++666.63.org+2001+0!+xmlenc7rsa91<," +>

SeminarsTopics.com
1.. 1/. 10. 20. 21. 22. 23. 2!. 2,. 2-. 2.. 2/. 20. <:ey;n o xmlns="$ttp5++666.63.org+2000+00+xmldsig7"> <:ey)ame>session<+:ey)ame> <+:ey;n o> <=ip$erData> <=ip$er>al&e>r! .?;1a@:?vi''A=ip$er>al&e> <+=ip$erData> <+Encrypted:ey> <+:ey;n o> <=ip$erData> <=ip$er>al&e>s2)$:Bc?ovip3dCD=D:EEE1FDdA<+=ip$er>al&e> <+=ip$erData> <+EncryptedData> <+articlein o>

30.<+article>

The author element and its children have &een replaced $ith the <EncryptedData> element $hich contains a num&er of other elements that are used to descri&e the encrypted data, i.e. the encryption algorithms used, the session %ey used, etc.
T e %Encrypte!Data& element

Loo%ing at the tree hierarchy of the <EncryptedData> element you can see the <EncryptedData> element is &ro%en do$n into a num&er of child elements. The <:ey;n o> element is the same as the <:ey;n o> element used in XML 8igital ignatures.

SeminarsTopics.com

The EncryptedData element is contained in the 9http-++$$$.$(.org+6))5+):+xmlenc;< namespace. #t is the root of the encrypted data. The Encryption1et$od element is used to specify the symmetric method used $hen encrypting the data. #t does this &y using an 7lgorithm attri&ute containing a .( =,L that descri&es the method used. 9http-++$$$.$(.org+6))5+):+xmlenc;aes60>-c&c9 indicates the data $as encrypted using 7E !,i?ndael" $ith a 60>% %ey si@e. The :ey;n o element is &orro$ed from XML 8igital ignatures and is used to store information a&out the symmetric %eys. The :ey;n o element can store information a&out more than one %ey. The Encrypted:ey element and its child elements contain information a&out one %ey stored in a :ey;n o element. The Encryption1et$od element of the :ey;n o contains the asymmetric encryption method used to encrypt the session %ey. #t does this using an 7lgorithm attri&ute set to a .( =,L. *or example- http-++$$$.$(.org+6))5+):+xmlenc;, 7-5A0 descri&es that , 7 asymmetric encryption $as used to encrypt the session %ey. The :ey)ame element is an identifier used to find the %ey. 4ou3ll see the importance of this later $hen it comes to coding XML Encryption. The =ip$erData and =ip$er>al&e elements that are found as part of the Encrypted:ey and EncryptedData elements contain the cipher data. The actual cipher data is stored in the =ip$er>al&e element. The Encrypted:ey element stores the encrypted %ey, $hile in the encrypted data is stored in the =ip$er>al&e for the EncryptedData element.

$symmetric XML encryption ' !ecryption process

$symmetric XML Encryption Process The process of XML encryption can &e summari@ed in five steps-

SeminarsTopics.com
1.

elect an element in an XML document !selecting the root $ill encrypt the $hole document".

2. Encrypt the element using a symmetric encryption %ey, %no$n as the session %ey. *. Encrypt the session %ey using asymmetric encryption !the pu&lic %ey is used". +. Create an EncryptedData element $hich $ill contain the encrypted data and the

encrypted session %ey.

5. ,eplace the original element $ith the EncryptedData element. Most of the steps are

performed automatically for you &y .'ET v6.) classes. $symmetric XML Decryption Process The process of decrypting the XML can &e summari@ed into four steps,
1.

elect the EncryptedData element in an XML document

2. 8ecrypt the session %ey using an asymmetric %ey !the private %ey is used" *. 8ecrypt the cipher data using the unencrypted symmetric encryption. +. ,eplace the EncryptedData element $ith the unencrypted element.

XML Encryption implementation !etails

Namespaces

The classes needed to perform XML Encryption can &e found in three namespaces. T$o methods have &een added to service the encryption requirements of different types of data !encryption granularity" .y#te".X"! / cont$in# XML c!$##e# th$t $re nee%e%

to cont$in XML %$t$. encryptElementC "mlDile for encryptin, $ p$rtic'!$r e!e"ent in the XML fi!e
encryptin, .y#te"..ec'rity.Crypto,r$phy / cont$in# encryption encryptElement=ontentC "mlDile for the content of $ p$rtic'!$r

e!e"ent in the XML fi!e

c!$##e# '#e% to ,ener$te encryption 0ey#.

.y#te"..ec'rity.Crypto,r$phy.X"! / cont$in# XML 7n online &oo%-&uyer can secure the sensitiveinformation in the purchase order &y employing Encryption c!$##e# th$t $re '#e% to perfor" the any of the follo$ing three XML encryption methods1. Encrypt $ co"p!ete XML fi!e 2. Encrypt $n e!e"ent in $n XML fi!e *. Encrypt $n e!e"ent-# content in $n XML fi!e encryption.

5. Encrypt a complete XML file $ith XML Encryption The &oo%-&uyer can encrypt the entire Brder.xml file to produce an XML-encrypted file, $hich can then &e sent to the pu&lisherCs sales department. 7lthough this provides relevant security through the end-to-end communication lin%, the &oo%-&uyerCs security policy is violated. This policy requires concealing the payment information in the sales department and revealing it in Super encryption the accounts department. #n this case, the $hole XML document is decrypted &y the sales When you use encryption, department and the payment information is disclosed. Therefore thissuper approach does you not can seem encrypt just the payment information with the suita&le, although it can &e practical if you use super encryption . accounts department's secret key to produce 6. Encrypt an element in an XML file $ith XML Encryption resultant file is then completely encrypted
using the sales department's secret key, thus resulting in a super-encrypted XML file. an element-encrypted XML file. This

SeminarsTopics.com The &oo%-&uyer can encrypt the payment information portion of the XML file $ith the accounts departmentCs secret %ey, and %eep the rest of the file content unencrypted for the sales department to vie$. This processing can &e performed &y encrypting the Dayment element in the Brder.xml file. The credit card information &ecomes secure. ince the security requirement dictates that the means of payment !such as credit card or &an% chec%" must &e hidden from unauthori@ed vie$ers, encrypting the Dayment element pays off. (. Encrypt an elementCs content in an XML file $ith XML Encryption The third encryption option the &oo%s-seller can exercise is to encrypt only the credit card num&er in Brder.xml. The element content encryption method is invo%ed, $hich encrypts only the textual content of the card num&er. This raises an important question- .hy do you need to come up $ith content encryption $hen the same can &e accomplished using element encryptionE The use of either method depends on the security policy for the documentF if there is a specific need to disclose the name of the element or its attri&utes, $hile %eeping its content secure, content encryption comes in handy.

(. $l)orit ms *se! for XML encryption.

This section discusses algorithms used $ith the XML Encryption specification. Entries contain the identifier to &e used as the value of the 8lgorit$m attri&ute of the Encryption1et$od element or other element representing the role of the algorithm, a reference to the formal specification, definitions for the representation of %eys and the results of cryptographic operations $here applica&le, and general applica&ility comments.
Table of Algorithms

The ta&le &elo$ lists the categories of algorithms. .ithin each category, a &rief name, the level of implementation requirement, and an identifying =,# are given for each algorithm.
"loc #ncryption 1. RE12IRE3 TRIPLE3E. 2. RE12IRE3 AE.4125 *. RE12IRE3 AE.4256 +. OPTIONAL AE.4172 Stream #ncryption 1. none $ey Transport 1. RE12IRE3 R.A481.5

SeminarsTopics.com
2. RE12IRE3 R.A4OAEP $ey %greement 1. OPTIONAL 3iffie49e!!"$n Symmetric $ey &rap 1. RE12IRE3 TRIPLE3E. :ey;r$p 2. RE12IRE3 AE.4125 :ey;r$p *. RE12IRE3 AE.4256 :ey;r$p +. OPTIONAL AE.4172 :ey;r$p Message 'igest 1. RE12IRE3 .9A1 2. RECOMMEN3E3 .9A256 *. OPTIONAL .9A512 +. OPTIONAL RIPEM34160 Message %uthentication 1. RECOMMEN3E3 XML 3i,it$! .i,n$t're (anonicali)ation 1. OPTIONAL C$nonic$! XML <o"it# co""ent#= 2. OPTIONAL C$nonic$! XML

ith Co""ent# ith Co""ent#

*. OPTIONAL E(c!'#i8e XML C$nonic$!i>$tion <o"it# co""ent#= +. OPTIONAL E(c!'#i8e XML C$nonic$!i>$tion #ncoding

1. RE12IRE3 &$#e6+

SeminarsTopics.com

+. Concl*sion.
XML Encryption is a .( tandard to encrypting XML. #t does this in such a $ay that the encrypted data remains and can &e treated as XML. #t uses &oth asymmetric and symmetric encryption algorithms, symmetric to encrypt the data and asymmetric to encrypt the symmetric session %ey. /oth the session %ey and the cipher data are stored together in an XML element called EncryptedData. The EncryptedData element contains a series of child elements that descri&e the algorithms used during the encryption process, as $ell as containing %ey information and the cipher data.