santuario-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brent Putman <>
Subject Re: JCEID to Service mapping
Date Mon, 11 Aug 2008 19:46:21 GMT
The JCEID algorithm identifier gets looked up by the relevant security 
provider class (e.g. Cipher), and is based on all 3 parameters: the 
cipher, mode and padding.

This is highly platform vendor and version specific but as far as I 
remember, support for the ISO10126 padding for XML Encryption was only 
available in later versions of the default provider stacks that ships 
with the Java runtimes.  With Sun's, for example, I believe 1.4 did 
*not* include support for that padding.  1.5 does now, although not sure 
about the initial patch revs.  I  seem to remember we had an issue in 
our project with someone using IBM's 1.5 JRE about a year and a half 
ago, and at that time they did not support that padding in the 
then-current rev of 1.5.  Not sure about now. In their 1.4 I'm guessing 
most likely not supported either.

If you can use recent Bouncy Castle security provider, that should get 
you support for that padding (and larger AES encryption keys) for any of 
the runtime platforms.  FYI, depending on what other crypto things 
you're doing, you may have to fiddle with the registered order of the 
providers in order to get everything to work as expected.

--Brent wrote:
> This isn't technically an XML Security issue, I know, but any help 
> appreciated.
> Under Java 1.5 when I try to create a, XMLCipher, XMLCipher.AES_128 is 
> mapped to a JCEID of AES/CBC/ISO10126Padding , whihc is then mapped to 
> a bouncycastle service of AES.  All is well.
> Under Java 1.4, XMLCipher.AES_128 is mapped to a JCEID of 
> AES/CBC/ISO10126Padding, but  no service provider can be found with 
> trhat JCEID, even though I can dump the service providers and see 3 
> AES providers.
> When I say under 1.5/1.4, its actually Websphere 6.0 (which uses 1.4) 
> and 6.1 (whihc uses 1.5).   I am going to try to isolate the code 
> outside of websphere to see if the behavior chnages, but trying to 
> understand what maps  AES/CBC/ISO10126Padding to a service...
> Ed Thompson

View raw message