XML Encryption
XML Encryption standard specifies
the process for encryptind data and representing the result in XML document.
The data may be an XML element, or an XML element content, or any arbitrary
data (including XML document).
XML Encryption Implementation and Interoperability Report
Features and algorithms
|
Key Word
|
XMLSec with OpenSSL |
XMLSec with GnuTLS |
XMLSec with NSS |
XMLSec with MSCrypto |
Laxly valid
schema generation of EncryptedData
/EncryptedKey
|
MUST
|
Y
|
Y
|
Y |
Y |
- Normalized Form C generations.
|
SHOULD
|
Y
|
Y |
Y |
Y |
Type, MimeType,
and Encoding
|
MUST
|
Y
|
Y |
Y |
Y |
CipherReference
URI derefencing
|
MUST
|
Y
|
Y |
Y |
Y |
|
OPTIONAL
|
Y
|
Y |
Y |
Y |
ds:KeyInfo
|
MUST
|
Y
|
Y |
Y |
Y |
|
OPTIONAL
|
N
|
N
|
N
|
N
|
|
RECOMMENDED
|
Y
|
Y |
Y |
Y |
|
REQUIRED
|
Y
|
Y |
Y |
Y |
ReferenceList
|
OPTIONAL
|
N
|
N
|
N
|
N
|
EncryptionProperties
|
OPTIONAL
|
Y
|
Y |
Y |
Y |
Satisfactory Performance
|
(required!)
|
Y
|
Y |
Y |
Y |
Required Type
support: Element and Content.
|
MUST
|
Y
|
Y |
Y |
Y |
Encryption
|
MUST
|
Y
|
Y |
Y |
Y |
- Serialization of XML Element and Content.
- NFC conversion from non-Unicode encodings.
|
MAY
MUST
|
Y
|
Y |
Y |
Y |
- Encryptor returns EncryptedData structure.
|
MUST
|
Y
|
Y |
Y |
Y |
- Encryptor replaces EncryptedData into source document (when Type is
Element or Content).
|
SHOULD
|
Y
|
Y |
Y |
Y |
Decryption
|
MUST
|
Y
|
Y |
Y |
Y |
- The decryptor returns the data and its Type to the application (be
it an octet sequence or key value).
|
MUST
|
Y
|
Y |
Y |
Y |
- If data is Element or Content the decryptor return the UTF-8 encoding
XML character data.
|
MUST
|
Y
|
Y |
Y |
Y |
- If data is Element or Content the decryptor replaces the EncryptedData
in the source document with the decrypted data.
|
SHOULD
|
Y
|
Y |
Y |
Y |
TRIPLEDES
|
REQUIRED
|
Y
|
Y |
Y |
Y |
AES-128
|
REQUIRED
|
Y
|
Y |
Y |
Y |
AES-256
|
REQUIRED
|
Y
|
Y |
Y |
Y |
AES-192
|
OPTIONAL
|
Y
|
Y |
Y |
Y |
RSA-v1.5 (192 bit keys for AES or DES)
|
REQUIRED
|
Y
|
N
|
N |
Y |
RSA-OAEP (128 and 256 bit keys for AES)
|
REQUIRED
|
Y(1)
|
N |
N |
N |
Diffie-Hellman Key Agreement
|
OPTIONAL
|
N
|
N |
N |
N |
TRIPLEDES Key Wrap
|
REQUIRED
|
Y
|
N |
Y |
N |
AES-128 Key Wrap (128 bit keys)
|
REQUIRED
|
Y
|
N |
Y
|
N
|
AES-256 Key Wrap (256 bit keys)
|
REQUIRED
|
Y
|
N |
Y
|
N
|
AES-192 Key Wrap
|
OPTIONAL
|
Y
|
N |
Y
|
N |
SHA1
|
REQUIRED
|
Y
|
Y
|
Y
|
Y
|
SHA256
|
RECOMMENDED
|
N
|
N |
N |
N |
SHA512
|
OPTIONAL
|
N
|
N |
N |
N |
RIPEMD-160
|
OPTIONAL
|
Y
|
Y
|
N
|
N
|
XML Digital
Signature
|
RECOMMENDED
|
Y
|
Y
|
Y
|
Y
|
Decryption
Transform for XML Signature
|
RECOMMENDED
|
N
|
N |
N |
N |
- XPointer support in
Except URI .
|
OPTIONAL
|
N
|
N |
N |
N |
Canonical XML
(with and without comments)
|
OPTIONAL
|
Y
|
Y
|
Y |
Y |
Exclusive
Canonicalization (with and without comments)
|
OPTIONAL
|
Y
|
Y |
Y |
Y |
base64 Encoding
|
REQUIRED
|
Y
|
Y |
Y |
Y |
|