[cpp-xmltooling COMMIT] in /branches/REL_1/xmltooling: XMLToolingConfig.cpp XMLToolingConfig.h encryption/Decrypter.h...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Mar  2 18:10:13 2012
New Revision: 966

URL: http://svn.shibboleth.net/view/cpp-xmltooling?rev=966&view=rev
Log:
Add option to reject unauthenticated ciphers

Modified:
    branches/REL_1/xmltooling/XMLToolingConfig.cpp
    branches/REL_1/xmltooling/XMLToolingConfig.h
    branches/REL_1/xmltooling/encryption/Decrypter.h
    branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp

Modified: branches/REL_1/xmltooling/XMLToolingConfig.cpp
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/XMLToolingConfig.cpp?rev=966&r1=965&r2=966&view=diff
==============================================================================
--- branches/REL_1/xmltooling/XMLToolingConfig.cpp (original)
+++ branches/REL_1/xmltooling/XMLToolingConfig.cpp Fri Mar  2 18:10:13 2012
@@ -714,6 +714,9 @@
     )
 {
     m_algorithmMap[type][xmlAlgorithm] = pair<string,unsigned int>((keyAlgorithm ? keyAlgorithm : ""), size);
+    // Authenticated encryption algorithms are also generic encryption algorithms.
+    if (type == ALGTYPE_AUTHNENCRYPT)
+        m_algorithmMap[ALGTYPE_ENCRYPT][xmlAlgorithm] = pair<string,unsigned int>((keyAlgorithm ? keyAlgorithm : ""), size);
 }
 
 bool XMLToolingInternalConfig::isXMLAlgorithmSupported(const XMLCh* xmlAlgorithm, XMLSecurityAlgorithmType type)

Modified: branches/REL_1/xmltooling/XMLToolingConfig.h
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/XMLToolingConfig.h?rev=966&r1=965&r2=966&view=diff
==============================================================================
--- branches/REL_1/xmltooling/XMLToolingConfig.h (original)
+++ branches/REL_1/xmltooling/XMLToolingConfig.h Fri Mar  2 18:10:13 2012
@@ -317,7 +317,8 @@
             ALGTYPE_SIGN,
             ALGTYPE_ENCRYPT,
             ALGTYPE_KEYENCRYPT,
-            ALGTYPE_KEYAGREE
+            ALGTYPE_KEYAGREE,
+            ALGTYPE_AUTHNENCRYPT
         };
 
         /**

Modified: branches/REL_1/xmltooling/encryption/Decrypter.h
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/encryption/Decrypter.h?rev=966&r1=965&r2=966&view=diff
==============================================================================
--- branches/REL_1/xmltooling/encryption/Decrypter.h (original)
+++ branches/REL_1/xmltooling/encryption/Decrypter.h Fri Mar  2 18:10:13 2012
@@ -52,14 +52,22 @@
         /**
          * Constructor.
          * 
+         * <p>The final boolean parameter is used to enforce a requirement for an authenticated cipher
+         * suite such as AES-GCM or similar. These ciphers include an HMAC or equivalent step that
+         * prevents tampering. Newer applications should set this parameter to true unless the ciphertext
+         * has been independently authenticated, and even in such a case, it is rarely possible to prevent
+         * chosen ciphertext attacks by trusted signers.
+         *
          * @param credResolver  locked credential resolver to supply decryption keys
          * @param criteria      optional external criteria to use with resolver
          * @param EKResolver    locates an EncryptedKey pertaining to the EncryptedData
+         * @param requireAuthenticatedCipher    true iff the bulk data encryption algorithm must be an authenticated cipher
          */
         Decrypter(
             const xmltooling::CredentialResolver* credResolver=nullptr,
             xmltooling::CredentialCriteria* criteria=nullptr,
-            const EncryptedKeyResolver* EKResolver=nullptr
+            const EncryptedKeyResolver* EKResolver=nullptr,
+            bool requireAuthenticatedCipher=false
             );
 
         virtual ~Decrypter();
@@ -148,6 +156,7 @@
         const xmltooling::CredentialResolver* m_credResolver;
         xmltooling::CredentialCriteria* m_criteria;
         const EncryptedKeyResolver* m_EKResolver;
+        bool m_requireAuthenticatedCipher;
     };
 
     DECL_XMLTOOLING_EXCEPTION(DecryptionException,XMLTOOL_EXCEPTIONAPI(XMLTOOL_API),xmlencryption,xmltooling::XMLToolingException,Exceptions in decryption processing);

Modified: branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp
URL: http://svn.shibboleth.net/view/cpp-xmltooling/branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp?rev=966&r1=965&r2=966&view=diff
==============================================================================
--- branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp (original)
+++ branches/REL_1/xmltooling/encryption/impl/Decrypter.cpp Fri Mar  2 18:10:13 2012
@@ -48,8 +48,14 @@
 using namespace xercesc;
 using namespace std;
 
-Decrypter::Decrypter(const CredentialResolver* credResolver, CredentialCriteria* criteria, const EncryptedKeyResolver* EKResolver)
-    : m_cipher(nullptr), m_credResolver(credResolver), m_criteria(criteria), m_EKResolver(EKResolver)
+
+Decrypter::Decrypter(
+    const CredentialResolver* credResolver,
+    CredentialCriteria* criteria,
+    const EncryptedKeyResolver* EKResolver,
+    bool requireAuthenticatedCipher

[... 129 lines stripped ...]