[cpp-xmltooling COMMIT] /branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Wed Aug 10 17:11:04 2011
New Revision: 898

URL: http://svn.shibboleth.net/view/cpp-xmltooling?rev=898&view=rev
Log:
Generate random key when key decryption fails.

Modified:
    branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp

Modified: branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp?rev=898&r1=897&r2=898&view=diff
==============================================================================
--- branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp (original)
+++ branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp Wed Aug 10 17:11:04 2011
@@ -348,5 +348,24 @@
         }
     }
     
-    throw DecryptionException("Unable to decrypt key.");
-}
+    // Some algorithms are vulnerable to chosen ciphertext attacks, so we generate a random key
+    // to prevent discovery of the validity of the original candidate.
+    logging::Category::getInstance(XMLTOOLING_LOGCAT".Decrypter").warn(
+        "unable to decrypt key, generating random key for defensive purposes"
+        );
+    pair<const char*,unsigned int> mapped = XMLToolingConfig::getConfig().mapXMLAlgorithmToKeyAlgorithm(algorithm);
+    if (!mapped.second)
+        mapped.second = 256;
+    try {
+        if (XSECPlatformUtils::g_cryptoProvider->getRandom(reinterpret_cast<unsigned char*>(buffer),mapped.second) < mapped.second)
+            throw DecryptionException("Unable to generate random data; was PRNG seeded?");
+        return handler->createKeyForURI(algorithm, buffer, mapped.second);
+    }
+    catch(XSECException& e) {
+        auto_ptr_char temp(e.getMsg());
+        throw DecryptionException(string("XMLSecurity exception while generating key: ") + temp.get());
+    }
+    catch (XSECCryptoException& e) {
+        throw DecryptionException(string("XMLSecurity exception while generating key: ") + e.getMsg());
+    }
+}