Encrypt with a Shared Symmetric Key Encrypt with a Random Symmetric Key

Oracle XML Security 8-17

8.9.5.2 If Callbacks are Not Set Up

If you did not set up callbacks, and you determined the key by yourself, you must call: ■ sig.verifybyte[] for HMAC keys or ■ sig.verifyPublicKey for DSARSA keys.

8.9.5.3 Debugging Verification

If you cannot determine why a particular signature does not verify, and you need to debug it, set the JVM property –Dxml.debug.verify=1. This flag instructs the Oracle Security Developer Tools to print diagnostic output to the stderr for failed signatures.

8.10 How to Encrypt Data with the Oracle XML Security API

This section describes various options for data encryption with Oracle XML Security.

8.10.1 Encrypt with a Shared Symmetric Key

To encrypt and replace the following importantInfo element: myDoc importantInfo ... importantInfo myDoc you will need to take the following steps: Assuming there is a shared symmetric key SecretKey dataEncKey = ... Create a new XEEncryptedData instance use either obj_Element or obj_Content depending on whether you want to encrypt the whole element or content only XEEncryptedData ed = XEEncryptedData .newInstancedoc, null, XMLURI.obj_Element; Specify the data encryption method XEEncryptionMethod em = ed.createEncryptionMethodXMLURI.alg_aes128_CBC; ed.setEncryptionMethodem; Create a Keyinfo with a hint to the symmetric key XEKeyInfo ki= ed.createKeyInfo; ki.addKeyInfoDataki.createKeyNameMyKey; ed.setKeyInfoki; Locate the importantInfo element Element impElem = ... Encrypt the importantInfo element and replace it with the EncryptedData element XEEncrytedData.encryptAndReplaceimpElem, dataEncKey, null, ed; 8-18 Oracle Fusion Middleware Reference for Oracle Security Developer Tools A Utility Method for Encryption There is a utility method which performs all these steps: XEncUtils.encryptElement impElem, element to be encrypted false, true = contentOnly, false = entire element XMLURI.alg_aes128_CBC, data encryption alg MyKey hint to data key ;

8.10.2 Encrypt with a Random Symmetric Key

In Section 8.10.1, Encrypt with a Shared Symmetric Key , the example made a simplifying assumption that there was a shared symmetric key. In practice, you usually generate a random symmetric key and encrypt with that key, and then encrypt this random symmetric key with the receiver’s public key. Here is how you would do that: Load up the encryption certificate of the reciever X509Certificate encCert = ... Get the reciever’s public key from the cert PublicKey keyEncKey = encCert.getPublicKey; Then generate a random symmetric key KeyGenerator keyGen = KeyGenerator.getInstanceAES; keyGen.init128; SecretKey dataEncKey = keyGen.generateKey; Now create an EncryptedKey object XEEncryptedKey = new XEEncryptedKeydoc; set up the key encryption algorithm XEEncryptionMethod em = ek.createEncryptionMethodXMLURI.alg_rsaOAEP_MGF1; em.setDigestMethodXMLURI.alg_sha1; ek.setEncryptionMethodem; encrypt the random symmetric key with public key byte[] cipherValue = ek.encryptdataEncKey, keyEncKey; store this cipherValue into ek XECipherData cd = ek.createCipherData; cd.setCipherValuecipherValue; ek.setCipherDatacd; decide on how you would let the receiver know the the key encryption key. We are putting in the entire reciever’s certificate XEKeyInfo kki = ek.createKeyInfo; kki.addKeyInfoDatakki.createX509DataencCert; Now the encrypted key has been set up, let us do the data encryption as before XEncUtils.encryptElement impElem, element to be encrypted false, true = contentOnly, false = entire element XMLURI.alg_aes128_CBC, data encryption alg Oracle XML Security 8-19 null No hint to data key ; Finally we need to put the EncryptedKey inside the KeyInfo of the EncryptedData ed.addKeyInfoDataek; A Utility Method for Encryption There is a utility method which performs all these steps: XEncUtils.encryptElement impElem, element to be encrypted false, true = contentOnly, false = entire element XMLURI.alg_aes128_CBC, data encryption alg dataEncKey, the random symmetric key that we generated XMLURI.alg_rsaOAEP_MGF1, key encryption alg KeyEncKey, public key that we got from cert RecieverCert A hint to the certificate ; Notice that this utility method puts KeyName in the EncryptedKey’s KeyInfo; if you want to pass X509Data instead, pass null for keyEncKeyName and then add the X509Data yourself: use utility method to create EncrytedData XEEncryptedData ed = XEncUtils... no extract EncryptedKey from it XEEncryptedKey ek = XEEncryptedKeyed.getKeyInfo .getEncryptedKeys.elementAt0; Set the keyInfo of the ek XEKeyInfo kki = ek.createKeyInfo; kki.addKeyInfoDatakki.createX509DataencCert;

8.11 How to Decrypt Data with the Oracle XML Security API