Re: Test case for OAEPparams? (RSA key transport)
Miklos Vajna <[email protected]> Mon, 13 Aug 2018 21:12:37 +0200
| Newsgroups | gmane.text.xml.xmlsec |
|---|---|
| Message-ID | <[email protected]> |
--===============1387880091== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="p4qYPpj5QlsIQJ0K" Content-Disposition: inline --p4qYPpj5QlsIQJ0K Content-Type: multipart/mixed; boundary="zYM0uCDKw75PZbzx" Content-Disposition: inline --zYM0uCDKw75PZbzx Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Hi, On Sun, Aug 12, 2018 at 02:15:01PM -0500, Aleksey Sanin <[email protected]> wrote: > I guess there were no test vectors for OAEPparams :( I am traveling and can > look into it in about a week. Otherwise, please feel free to add a test > yourself. Here is what I tried: take <OAEPparams> from tests/merlin-xmlenc-five/encrypt-data-tripledes-cbc-rsa-oaep-mgf1p-sha256.xml, create a variant of tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.tmpl with "-params" suffix that has <OAEPparams>; but then openssl can't decrypt the encryption result: ---- $ ~/git/xmlsec/apps/xmlsec1 decrypt --crypto openssl --crypto-config /tmp/xmlsec-crypto-config --pkcs12 /home/vmiklos/git/xmlsec/tests/01-phaos-xmlenc-3/rsa-priv-key.p12 --pwd secret --output /tmp/testEnc.sh.20180813_211026-16455.tmp.2 /tmp/testEnc.sh.20180813_211026-16455.tmp func=xmlSecOpenSSLEvpBlockCipherCBCCtxFinal:file=ciphers.c:line=465:obj=aes256-cbc:subj=unknown:error=12:invalid data:invalid data: actual value 'padLen'=17, actual value 'blockLen'=16 and expected padLen <= blockLen func=xmlSecOpenSSLEvpBlockCipherExecute:file=ciphers.c:line=837:obj=aes256-cbc:subj=xmlSecOpenSSLEvpBlockCipherCtxFinal:error=1:xmlsec library function failed: func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1929:obj=aes256-cbc:subj=xmlSecTransformExecute:error=1:xmlsec library function failed:final=1 func=xmlSecTransformDefaultPushBin:file=transforms.c:line=1954:obj=aes256-cbc:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed:final=1;outSize=144 func=xmlSecTransformCtxBinaryExecute:file=transforms.c:line=942:obj=unknown:subj=xmlSecTransformPushBin:error=1:xmlsec library function failed:dataSize=194 func=xmlSecEncCtxDecryptToBuffer:file=xmlenc.c:line=616:obj=unknown:subj=xmlSecTransformCtxBinaryExecute:error=1:xmlsec library function failed: func=xmlSecEncCtxDecrypt:file=xmlenc.c:line=526:obj=unknown:subj=xmlSecEncCtxDecryptToBuffer:error=1:xmlsec library function failed: ---- At this point I think I'm more comfortable to do anything regarding this once I see a test that works with openssl first. :-) I attach the patch if it's of any help. And sure, it's not urgent at all. Thanks, Miklos --zYM0uCDKw75PZbzx Content-Type: text/x-patch; charset=utf-8 Content-Disposition: attachment; filename="0001-WIP.patch" Content-Transfer-Encoding: quoted-printable =46rom 25f78b2f0ffc393a73b9dab2d88dbbac00db50db Mon Sep 17 00:00:00 2001 =46rom: Miklos Vajna <[email protected]> Date: Sun, 12 Aug 2018 21:34:34 +0200 Subject: [PATCH] WIP --- .../enc-text-aes256-kt-rsa_oaep_sha1-params.data | 9 +++ .../enc-text-aes256-kt-rsa_oaep_sha1-params.tmpl | 25 +++++++++ .../enc-text-aes256-kt-rsa_oaep_sha1-params.xml | 64 ++++++++++++++++++= ++++ tests/testEnc.sh | 8 +++ 4 files changed, 106 insertions(+) create mode 100644 tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha= 1-params.data create mode 100644 tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha= 1-params.tmpl create mode 100644 tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha= 1-params.xml diff --git a/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-param= s.data b/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.da= ta new file mode 100644 index 00000000..1d794286 --- /dev/null +++ b/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.data @@ -0,0 +1,9 @@ +<?xml version=3D"1.0" encoding=3D"UTF-8"?> +<PaymentInfo xmlns=3D"http://example.org/paymentv2"> + <Name>John Smith</Name> + <CreditCard Currency=3D"USD" Limit=3D"5,000"> + <Number>4019 2445 0277 5567</Number> + <Issuer>Bank of the Internet</Issuer> + <Expiration Time=3D"04/02"/> + </CreditCard> +</PaymentInfo> diff --git a/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-param= s.tmpl b/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.tm= pl new file mode 100644 index 00000000..303abf00 --- /dev/null +++ b/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.tmpl @@ -0,0 +1,25 @@ +<?xml version=3D"1.0" encoding=3D"UTF-8"?>=0D +<EncryptedData Id=3D"ED" Type=3D"http://www.w3.org/2001/04/xmlenc#Content"= xmlns=3D"http://www.w3.org/2001/04/xmlenc#">=0D + <EncryptionMethod Algorithm=3D"http://www.w3.org/2001/04/xmlenc#aes= 256-cbc"/>=0D + <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#">=0D + <EncryptedKey Id=3D"EK" xmlns=3D"http://www.w3.org/2001/04/xmlenc#">=0D + <EncryptionMethod Algorithm=3D"http://www.w3.org/2001/04/xmlenc#rsa= -oaep-mgf1p">=0D + <ds:DigestMethod Algorithm=3D"http://www.w3.org/2000/09/xmldsig#= sha1" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"/>=0D + <OAEPparams>=0D + MTIzNDU2Nzg=3D=0D + </OAEPparams>=0D + </EncryptionMethod>=0D + <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#">=0D + <ds:KeyName>my-rsa-key</ds:KeyName>=0D + </ds:KeyInfo>=0D + <CipherData>=0D + <CipherValue>=0D + </CipherValue>=0D + </CipherData>=0D + </EncryptedKey>=0D + </ds:KeyInfo>=0D + <CipherData>=0D + <CipherValue>=0D + </CipherValue>=0D + </CipherData>=0D +</EncryptedData>=0D diff --git a/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-param= s.xml b/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.xml new file mode 100644 index 00000000..a44829f7 --- /dev/null +++ b/tests/01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params.xml @@ -0,0 +1,64 @@ +<?xml version=3D"1.0" encoding=3D"UTF-8"?> +<PaymentInfo xmlns=3D"http://example.org/paymentv2"> + <Name>John Smith</Name> + <CreditCard Currency=3D"USD" Limit=3D"5,000"> + <Number><EncryptedData Id=3D"ED" Type=3D"http://www.w3.org/2001/04/xml= enc#Content" xmlns=3D"http://www.w3.org/2001/04/xmlenc#"> + <EncryptionMethod Algorithm=3D"http://www.w3.org/2001/04/xmlenc#aes= 256-cbc"/> + <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> + <EncryptedKey Id=3D"EK" xmlns=3D"http://www.w3.org/2001/04/xmlenc#"> + <EncryptionMethod Algorithm=3D"http://www.w3.org/2001/04/xmlenc#rsa= -oaep-mgf1p"> + <ds:DigestMethod Algorithm=3D"http://www.w3.org/2000/09/xmldsig#= sha1" xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"/> + </EncryptionMethod> + <ds:KeyInfo xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#"> + <ds:KeyName>my-rsa-key</ds:KeyName> + <ds:X509Data> + <ds:X509Certificate> + MIIDzTCCArWgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBljELM= AkGA1UEBhMCVVMx + CzAJBgNVBAgTAk5ZMRIwEAYDVQQHEwlNYW5oYXR0YW4xFTATBg= NVBAoTDExhdmEg + U3VwcmVtZTEUMBIGA1UECxMLSGVhZCBPZmZpY2UxFDASBgNVB= AMTC1JTQSBUZXN0 + IENBMSMwIQYJKoZIhvcNAQkBFhR0ZWNoQGxhdmFzdXByZW1lL= m9yZzAeFw0wMjAx + MzExNjI5NDNaFw00MzAyMjUxNjI5NDNaMIGWMQswCQYDVQQGE= wJVUzELMAkGA1UE + CBMCTlkxEjAQBgNVBAcTCU1hbmhhdHRhbjEVMBMGA1UEChMMT= GF2YSBTdXByZW1l + MRQwEgYDVQQLEwtIZWFkIE9mZmljZTEUMBIGA1UEAxMLUlNBI= FRlc3QgQ0ExIzAh + BgkqhkiG9w0BCQEWFHRlY2hAbGF2YXN1cHJlbWUub3JnMIIBI= jANBgkqhkiG9w0B + AQEFAAOCAQ8AMIIBCgKCAQEAgj3TOyUtgg99oEfsm8h9JTZBx= UkzYkXVUOHxIwnk + Fwp4y9ZnrGja/j+kpRyKvYP5CkNdq0e58/r7GLXj45iqd03Xj= sFNTdjy4OIOgf7J + xMG7z+hEB1LT2swTs10GILFWPByRl3/BEsnekLZdoqNoJrvnt= tVkxgu3x80Ji3/A + ZD8Ub/kBGOSPyu6pn3OdnMTc5q4r1qUe985lQzCZvCMw6AoGe= CyJodNu2MbveNeH + +YPjRgLCQfzvOFRq+9qMtE8XfUJZdNhPZhgdsOGf8uJauTcIH= bAyw7BhxPy6RikW + W5yiWUmBya+7t4y1TQJzham/0y0zU3TAA7b/rDrU7xmNPwIDA= QABoyQwIjAPBgNV + HRMBAf8EBTADAQH/MA8GA1UdDwEB/wQFAwMHBgAwDQYJKoZIh= vcNAQEEBQADggEB + ADELWZjFLPjSjGeOaeUwH/mEOP+l/nTtxe07IWAQL4kvb4wsi= UsM1EkPptcBQsym + OYgFhf3Elqma84bbOyp85y/iQnjpqWWJ73TFXSWZamSIhYb4G= k+dQuwFI+zD3B2y + WwqghaAHDzxtzROLUBjo+97Y6ng6V5zjmtdGOFwNXwWhf3Y+M= jnErtBIKYao8NJO + p6di80w82+s6Ot+CLVvVobLhxS/y8yWplATRiQnI5ij/WTLML= +tiU5aes0c9abaf + O7i9j1iTuZsDT3f96ia0RSLsXSGij737QKc3ZM8lSxBWfepWY= O+G+IRgr1q9IUDa + kKO/vB9Ay64Rt88XbLnnGns=3D + </ds:X509Certificate> + </ds:X509Data> + </ds:KeyInfo> + <CipherData> + <CipherValue> + FCMw2HiQoGdINvvQYoMdRH0fE5oM9i3E9D4IRx9nwvnZLbA/Oi5= snoKYEjYQ8ALK + QxYkGKhHtvwsUpVyxA9wGxbNP19Qt1yJIthG6mHUrGTcN9iYvY8= 5FacG3NQWmdMh + HjqmylWZAqY4b+qDHczciqzT9i/M3AVct8RrgfVL/MgYyo1WLM0= n+svRtc+GFYu6 + QupE5bV1UFb/x3FaQtlzm6fIin+BSThCPKfnanj5Z1rAZsi7Wo9= TiK610DKh9zXx + ONfiLcv9fpoHxpsEzCvAp+RUzLTuqxsLR1rdOveQLy/lTx9eClK= 8YepzlQIaXiOY + y0UqwPAQnEjuVzOmT3CsrQ=3D=3D + </CipherValue> + </CipherData> + <ReferenceList> + <DataReference URI=3D"#ED"/> + </ReferenceList> + </EncryptedKey> + </ds:KeyInfo> + <CipherData> + <CipherValue> + DpNYC0Np5hHaQAUyHWpM3MQ99wkDFtGRc7TywqxmhI4sJKDXM5SRjVl= Kf6st5wOz + </CipherValue> + </CipherData> + </EncryptedData></Number> + <Issuer>Bank of the Internet</Issuer> + <Expiration Time=3D"04/02"/> + </CreditCard> +</PaymentInfo> diff --git a/tests/testEnc.sh b/tests/testEnc.sh index d7e7a17b..4c929fc3 100755 --- a/tests/testEnc.sh +++ b/tests/testEnc.sh @@ -279,6 +279,14 @@ execEncTest $res_success \ "--session-key aes-256 --keys-file $topfolder/01-phaos-xmlenc-3/keys.x= ml --enabled-key-data key-name --xml-data $topfolder/01-phaos-xmlenc-3/enc-= text-aes256-kt-rsa_oaep_sha1.data --node-name http://example.org/paymentv2:= CreditCard" \ "$priv_key_option $topfolder/01-phaos-xmlenc-3/rsa-priv-key.$priv_key_= format --pwd secret" =20 +execEncTest $res_success \ + "" \ + "01-phaos-xmlenc-3/enc-text-aes256-kt-rsa_oaep_sha1-params" \ + "aes256-cbc rsa-oaep-mgf1p" \ + "$priv_key_option $topfolder/01-phaos-xmlenc-3/rsa-priv-key.$priv_key_= format --pwd secret" \ + "--session-key aes-256 --keys-file $topfolder/01-phaos-xmlenc-3/keys.x= ml --enabled-key-data key-name --xml-data $topfolder/01-phaos-xmlenc-3/enc-= text-aes256-kt-rsa_oaep_sha1-params.data --node-name http://example.org/pay= mentv2:CreditCard" \ + "$priv_key_option $topfolder/01-phaos-xmlenc-3/rsa-priv-key.$priv_key_= format --pwd secret" + execEncTest $res_success \ "" \ "01-phaos-xmlenc-3/enc-element-3des-kw-3des" \ --=20 2.16.4 --zYM0uCDKw75PZbzx-- --p4qYPpj5QlsIQJ0K Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- iFwEARECAB0WIQSK0+WTigfbXWePMdJ7zW0CA5FQlgUCW3HYJAAKCRB7zW0CA5FQ ls8LAJjsaxKQdW8AyAtKcClSDo4/g0sDAJ4rFcl2i+c0Xh4OHXFVSnT1LksAMQ== =fSnI -----END PGP SIGNATURE----- --p4qYPpj5QlsIQJ0K-- --===============1387880091== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeG1sc2VjIG1h aWxpbmcgbGlzdAp4bWxzZWNAYWxla3NleS5jb20KaHR0cDovL3d3dy5hbGVrc2V5LmNvbS9tYWls bWFuL2xpc3RpbmZvL3htbHNlYwo= --===============1387880091==--