http://debianws.lexgopc.com/wiki143/index.php?action=history&feed=atom&title=XML_EncryptionXML Encryption - Revision history2026-10-26T23:28:19ZRevision history for this page on the wikiMediaWiki 1.43.1http://debianws.lexgopc.com/wiki143/index.php?title=XML_Encryption&diff=1788071&oldid=previmported>Desaccointier: /* Sources */2024-10-07T19:37:54Z<p><span class="autocomment">Sources</span></p>
<p><b>New page</b></p><div>{{Short description|W3C specification for XML element encryption}}<br />
'''XML Encryption''' ('''XML-Enc''') is a specification governed by a [[World Wide Web Consortium]] (W3C) recommendation, that defines how to [[encrypt]] the contents of an [[XML]] element.<br />
<br />
==Specification==<br />
Although XML Encryption can be used to encrypt any kind of data, it is nonetheless known as "XML Encryption" because an XML element (either an <code>EncryptedData</code> or <code>EncryptedKey</code> element) contains or refers to the cipher text, keying information, and algorithms.{{sfnp|XMLENC 1.0|loc=section 2}}<br />
<br />
Both [[XML Signature]] and XML Encryption use the <code>KeyInfo</code> element, which appears as the child of a <code>SignedInfo</code>, <code>EncryptedData</code>, or <code>EncryptedKey</code> element and provides information to a recipient about what keying material to use in validating a signature or decrypting encrypted data.<br />
<br />
The <code>KeyInfo</code> element is optional: it can be attached in the message, or be delivered through a secure channel.<br />
<br />
XML Encryption is different from and unrelated to [[Transport Layer Security]] (TLS), which is used to send encrypted messages (including XML content, both encrypted and otherwise) over the internet.<br />
<br />
{{harvtxt|Jager|Somorovsky|2011}} reported that this specification has severe security concerns. In response to this,{{sfnb|Jager|Paterson|Somorovsky|2013}} the specification of XML Encryption 1.1 published in 2013 included a [[Galois/Counter Mode]] block cypher algorithm.{{sfnp|Kupser|Mainka|Schwenk|Somorovsky|2015}}{{clarification needed|date=September 2024}}<br />
<br />
== References ==<br />
<br />
===Citations===<br />
{{Reflist}}<br />
<br />
===Sources===<br />
{{refbegin}}<br />
* {{cite web|first1=T.|last1=Imamura|first2=B.|last2=Dillaway|first3=E.|last3=Simon|date=10 December 2002|title=XML Encryption Syntax and Processing|editor-first1=D.|editor-last1=Eastlake|editor-first2=J.|editor-last2=Reagle|url=https://www.w3.org/TR/2002/REC-xmlenc-core-20021210|publisher=[[W3C]]|ref={{sfnref|XMLENC 1.0}}}}<br />
* {{cite web|first1=T.|last1=Imamura|first2=B.|last2=Dillaway|first3=E.|last3=Simon|first4=K.|last4=Yiu|first5=M.|last5=Nyström|date=11 April 2013|title=XML Encryption Syntax and Processing Version 1.1|editor-first1=D.|editor-last1=Eastlake|editor-first2=J.|editor-last2=Reagle|editor-first3=F.|editor-last3=Hirsch|editor-first4=T.|editor-last4=Roessler|url=https://www.w3.org/TR/2013/REC-xmlenc-core1-20130411|publisher=[[W3C]]|ref={{sfnref|XMLENC 1.1}}}}<br />
* {{cite book|date=19 October 2011|last1=Jager|first1=T.|last2=Somorovsky|first2=J.|chapter=How to break XML encryption |title=Proceedings of the 18th ACM conference on Computer and communications security|pages=413–422|doi=10.1145/2046707.2046756|isbn=978-1-4503-0948-6|publisher=Association for Computing Machinery|location=New York}}<br />
* {{cite web|editor-first=F.|editor-last=Hirsch|date=11 April 2013|title=Functional Explanation of Changes in XML Encryption 1.1|url=https://www.w3.org/TR/2013/NOTE-xmlenc-core1-explain-20130411|publisher=W3C}}<br />
* {{cite conference|date=June 2012|first1=J.|last1=Somorovsky|first2=J.|last2=Schwenk|title=Technical Analysis of Countermeasures against Attack on XML Encryption – or – Just Another Motivation for Authenticated Encryption|url=https://www.w3.org/2008/xmlsec/papers/xmlEncCountermeasuresW3C.pdf|conference=2012 IEEE Eighth World Congress on Services|doi=10.1109/SERVICES.2012.6|publisher=IEEE|isbn=978-1-4673-3053-4}}<br />
* {{cite conference|first1=T.|last1=Jager|first2=K. G.|last2=Paterson|first3=J.|last3=Somorovsky|date=24 April 2013|title=One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography|url=https://www.ndss-symposium.org/ndss2013/ndss-2013-programme/one-bad-apple-backwards-compatibility-attacks-state-art-cryptography/|conference=NDSS Symposium 2013}}<br />
* {{cite conference|first1=D.|last1=Kupser|first2=C.|last2=Mainka|first3=J.|last3=Schwenk|first4=J.|last4=Somorovsky|date=August 2015|title=How to Break XML Encryption – Automatically|conference=9th USENIX Workshop on Offensive Technologies (WOOT '15)|url=https://www.usenix.org/conference/woot15/workshop-program/presentation/kupser}}<br />
{{refend}}<br />
<br />
==External links==<br />
* [http://www.w3.org/TR/xmlenc-core/ W3C info]<br />
* [http://santuario.apache.org/ Apache Santuario - Apache XML Security Implementation for Java and C++]<br />
* [http://www.aleksey.com/xmlsec/ XMLSec - XML Security Library for C]<br />
* [http://users.dcc.uchile.cl/~pcamacho/tutorial/web/xmlsec/xmlsec.html An Introduction to XML Signature and XML Encryption with XMLSec]<br />
{{W3C standards}}<br />
<br />
[[Category:XML]]<br />
[[Category:Cryptography standards]]<br />
[[Category:XML-based standards]]</div>imported>Desaccointier