XML Encryption Syntax and Processing

Abstract

This document specifies a process for encrypting data and representing the result in XML. The data may be arbitrary data (including an XML document), an XML element, or XML element content. The result of encrypting data is an XML Encryption element which contains or references the cipher data.

Status of this document

This is an Editors' draft with no official standing.

Table of Contents

1. Introduction
   1. Editorial and Conformance Conventions
   2. Design Philosophy
   3. Versions, Namespaces and Identifiers
   4. Acknowledgements
2. Encryption Overview and Examples
   1. Encryption Granularity
      1. Encrypting an XML Element
      2. Encrypting XML Element Content (Elements)
      3. Encrypting XML Element Content (Character Data)
      4. Encrypting Arbitrary Data and XML Documents
      5. Super-Encryption: Encrypting EncryptedData
   2. EncryptedData and EncryptedKey Usage
      1. EncryptedData with Symmetric Key  (KeyName)
      2. EncryptedKey (ReferenceList, ds:RetrievalMethod,CarriedKeyName)
3. Encryption Syntax
   1. The EncryptedType
   2. The CipherData Element
      1. The CipherReference Element
   3. The EncryptedData Element
   4. Extensions to ds:KeyInfo Element
      1. The EncryptedKey Element
      2. The ds:RetrievalMethod Element
   5. The ReferenceList Element
   6. The EncryptionProperties Element
4. Processing Rules
   1. Encryption
   2. Decryption
   3. Encrypting XML
5. Algorithms
   1. Algorithm Identifiers and Implementation Requirements
   2. Block Encryption Algorithms
   3. Stream Encryption Algorithms
   4. Key Transport
   5. Key Agreement
   6. Symmetric Key Wrap
   7. Message Digest
   8. Message Authentication
   9. Canonicalization
6. Security Considerations
7. Schema and Valid Examples
8. References

5.6.3 AES KeyWrap

Identifiers and Requirements:

http://www.w3.org/2001/04/xmlenc#kw-aes128 (REQUIRED)

http://www.w3.org/2001/04/xmlenc#kw-aes192 (OPTIONAL)

http://www.w3.org/2001/04/xmlenc#kw-aes256 (REQUIRED)

Implementation of AES key wrap is described below, as suggested by NIST. It provides for confidentiality and integrity. This algorithm is defined only for inputs which are a multiple of 64 bits. The information wrapped need not actually be a key. The algorithm is the same whatever the size of the AES key used in wrapping, called the key encrypting key or KEK. The implementation requirements are indicated below.

Assume tha the data to be wrapped consists of N 64-bit data blocks denoted P(1), P(2), P(3) ... P(N). The result of wrapping will be N+1 64-bit blocks denoted C(0), C(1), C(2), ... C(N). They key encrypting key is represented by K. Assume integers i, j, and t and intermediate 64-bit register A, 128-bit register B, and array of 64-bit quantities R(1) through R(N). "|" represents concatentation so x|y, where x and y and 64-bit quantities, is the 128-bit quantity with x in the most significant bits and y in the least significant bits. AES(K)enc(x) is the operation of AES encrypting the 128-bit quantity x under the key K. AES(K)dec(x) is the corresponding decryption opteration. XOR(x,y) is the bitwise exclusive or of x and y. MSB(x) and LSB(y) are the most significant 64 bits and least significant 64 bits of x and y respectively.

If N is 1, a single AES operation is performed for wrap or unwrap. If N>1, then 6*N AES operations are performed for warp or unwrap.

The key wrap algorithm is as follows:

1. If N is 1:
   • B=AES(K)enc(0xA6A6A6A6A6A6A6A6|P(1))
   • C(0)=MSB(B)
   • C(1)=LSB(B)
   If N>1, perform the following steps:
2. Initialize variables:
   • Set A to 0xA6A6A6A6A6A6A6A6
   • For i=1 to N,
     R(i)=P(i)
3. Calculate intermediate values:
   • For j=0 to 5,
     • For i=1 to N,
       t= i + j*N
       B=AES(K)enc(A|R(i))
       A=XOR(t,MSB(B))
       R(i)=LSB(B)
4. Output the results:
   • Set C(0)=A
   • For i=1 to N,
     C(i)=R(i)

The key unwrap algorithm is as follows:

1. If N is 1:
   • B=AES(K)dec(C(0)|C(1))
   • P(1)=LSB(B)
   • If MSB(B) is 0xA6A6A6A6A6A6A6A6, return success. Otherwise, return an integrity check failure error.
   If N>1, perform the following steps:
2. Initialize the variables:
   • A=C(0)
   • For i=1 to N,
     R(i)=C(i)
3. Calculate intermediate values:
   • For j=5 to 0,
     • For i=N to 1,
       t= i + j*N
       B=AES(K)dec(XOR(t,A)|R(i))
       A=MSB(B)
       R(i)=LSB(B)
4. Output the results:
   • For i=1 to N,
     P(i)=R(i)
   • If A is 0xA6A6A6A6A6A6A6A6, return success. Otherwise, return an integrity check failure error.

For example, wrapping the data 0x00112233445566778899AABBCCDDEEFF with the KEK 0x000102030405060708090A0B0C0D0E0F produces the ciphertext of 0x1FA68B0A8112B447, 0xAEF34BD8FB5A7B82, 0x9D3E862371D2CFE5.