XML Encryption

Technopedia Center

Faculty of Engineering and Computer Science
S1 Informatics S1 Information Systems S1 Information Technology S1 Computer Engineering S1 Electrical Engineering S1 Civil Engineering

faculty of Economics and Business
S1 Management S1 Accountancy

Faculty of Letters and Educational Sciences
S1 English literature S1 English language education S1 Mathematics education S1 Sports Education

XML Encryption

From Wikipedia, the free encyclopedia

XML Encryption (XML-Enc) is a specification governed by a World Wide Web Consortium (W3C) recommendation, that defines how to encrypt the contents of an XML element.

Specification

[edit]

Although XML Encryption can be used to encrypt any kind of data, it is nonetheless known as "XML Encryption" because an XML element (either an EncryptedData or EncryptedKey element) contains or refers to the cipher text, keying information, and algorithms.^[1]

Both XML Signature and XML Encryption use the KeyInfo element, which appears as the child of a SignedInfo, EncryptedData, or EncryptedKey element and provides information to a recipient about what keying material to use in validating a signature or decrypting encrypted data.

The KeyInfo element is optional: it can be attached in the message, or be delivered through a secure channel.

XML Encryption is different from and unrelated to Transport Layer Security (TLS), which is used to send encrypted messages (including XML content, both encrypted and otherwise) over the internet.

Jager & Somorovsky (2011) reported that this specification has severe security concerns. In response to this,^[2] the specification of XML Encryption 1.1 published in 2013 included a Galois/Counter Mode block cypher algorithm.^[3]^{[clarification needed]}

References

[edit]

Citations

[edit]

^ XMLENC 1.0, section 2.
^ Jager, Paterson & Somorovsky (2013).
^ Kupser et al. (2015).

Sources

[edit]

Imamura, T.; Dillaway, B.; Simon, E. (10 December 2002). Eastlake, D.; Reagle, J. (eds.). "XML Encryption Syntax and Processing". W3C.
Imamura, T.; Dillaway, B.; Simon, E.; Yiu, K.; Nyström, M. (11 April 2013). Eastlake, D.; Reagle, J.; Hirsch, F.; Roessler, T. (eds.). "XML Encryption Syntax and Processing Version 1.1". W3C.
Jager, T.; Somorovsky, J. (19 October 2011). "How to break XML encryption". Proceedings of the 18th ACM conference on Computer and communications security. New York: Association for Computing Machinery. pp. 413–422. doi:10.1145/2046707.2046756. ISBN 978-1-4503-0948-6.
Hirsch, F., ed. (11 April 2013). "Functional Explanation of Changes in XML Encryption 1.1". W3C.
Somorovsky, J.; Schwenk, J. (June 2012). Technical Analysis of Countermeasures against Attack on XML Encryption – or – Just Another Motivation for Authenticated Encryption (PDF). 2012 IEEE Eighth World Congress on Services. IEEE. doi:10.1109/SERVICES.2012.6. ISBN 978-1-4673-3053-4.
Jager, T.; Paterson, K. G.; Somorovsky, J. (24 April 2013). One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography. NDSS Symposium 2013.
Kupser, D.; Mainka, C.; Schwenk, J.; Somorovsky, J. (August 2015). How to Break XML Encryption – Automatically. 9th USENIX Workshop on Offensive Technologies (WOOT '15).

External links

[edit]

World Wide Web Consortium (W3C)

Products and
standards

Recommendations	ActivityPub Activity Streams ARIA Canonical XML CDF CSS Animations Flexbox Grid DOM EXI EmotionML Geolocation API HTML HTML5 IndexedDB ITS JSON-LD Linked Data Notifications MathML Micropub OWL PLS RDF Schema SISR SKOS SMIL SOAP SRGS SRI SSML SVG Filter Effects SCXML SHACL SPARQL Timed text VoiceXML WebAssembly WoT TD Web storage WSDL Webmention WebSub WebVTT WOFF XHTML +RDFa XML Base Encryption Events Information Set Namespace Schema Signature XForms XInclude XLink XOP XPath 2.0 3.x XPointer XProc XQuery XSL XSL-FO XSLT elements
Notes	IndieAuth XAdES XBL XHTML+SMIL XUP
Working drafts	CCXML CURIE EME InkML MSE RIF SMIL Timesheets sXBL WebGPU WebXR XFDL XFrames XMLHttpRequest
Guidelines	Web Content Accessibility Guidelines
Initiative	Markup Validation Service Web Accessibility Initiative Web Components
Deprecated	C-HTML HDML JSSS PGML VML WebPlatform
Obsoleted	P3P XHTML+MathML+SVG

Organizations

World Wide Web Foundation WHATWG
Elected groups	AB Board TAG
Working groups	CSS SVG WebAssembly WebAuthn
Community & business groups	Web Advertising BG WebAssembly CG
Closed groups	Device Description (DDWG) HTML Multimodal Interaction Activity (MMI)

Software

CERN httpd Libwww
Browsers	Line Mode (1990–) Arena (1993–98) Agora (1994–97) Argo (1994–97) Amaya (browser/editor, 1996–2012)

Conferences

International World Wide Web Conference (IW3C)
- Steering Committee (IW3C2)
- First conference ("WWW1", 1994)

Retrieved from "https://en.wikipedia.org/w/index.php?title=XML_Encryption&oldid=1249966462"

Categories:

Hidden categories: