santuario-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Sean Mullan <Sean.Mul...@Sun.COM>
Subject Re: JCEID to Service mapping
Date Mon, 11 Aug 2008 20:27:21 GMT
Brent Putman wrote:
> The JCEID algorithm identifier gets looked up by the relevant security 
> provider class (e.g. Cipher), and is based on all 3 parameters: the 
> cipher, mode and padding.
> This is highly platform vendor and version specific but as far as I 
> remember, support for the ISO10126 padding for XML Encryption was only 
> available in later versions of the default provider stacks that ships 
> with the Java runtimes.  With Sun's, for example, I believe 1.4 did 
> *not* include support for that padding.  

This is correct. It is available in JDK 1.5 and up.

> 1.5 does now, although not sure 
> about the initial patch revs.  I  seem to remember we had an issue in 
> our project with someone using IBM's 1.5 JRE about a year and a half 
> ago, and at that time they did not support that padding in the 
> then-current rev of 1.5.  Not sure about now. In their 1.4 I'm guessing 
> most likely not supported either.

I believe that is also correct (1.5 and up).

BTW, I believe if you encode (or maybe its the other way around, I can't 
remember for sure) with PKCS5Padding and decode with ISO10126Padding, it 
is ok. It is only the other way around that you get problems. This might 
work if the application that encrypts cannot be upgraded (encode with 
JDK 1.4 and PKCS5Padding and decode with JDK 1.5 and ISO10126Padding), 
although you would have to tweak the algorithm URI mappings in 
config.xml to use PKCS5Padding instead.


> If you can use recent Bouncy Castle security provider, that should get 
> you support for that padding (and larger AES encryption keys) for any of 
> the runtime platforms.  FYI, depending on what other crypto things 
> you're doing, you may have to fiddle with the registered order of the 
> providers in order to get everything to work as expected.
> --Brent
> wrote:
>> This isn't technically an XML Security issue, I know, but any help 
>> appreciated.
>> Under Java 1.5 when I try to create a, XMLCipher, XMLCipher.AES_128 is 
>> mapped to a JCEID of AES/CBC/ISO10126Padding , whihc is then mapped to 
>> a bouncycastle service of AES.  All is well.
>> Under Java 1.4, XMLCipher.AES_128 is mapped to a JCEID of 
>> AES/CBC/ISO10126Padding, but  no service provider can be found with 
>> trhat JCEID, even though I can dump the service providers and see 3 
>> AES providers.
>> When I say under 1.5/1.4, its actually Websphere 6.0 (which uses 1.4) 
>> and 6.1 (whihc uses 1.5).   I am going to try to isolate the code 
>> outside of websphere to see if the behavior chnages, but trying to 
>> understand what maps  AES/CBC/ISO10126Padding to a service...
>> Ed Thompson

View raw message