[cpp-opensaml COMMIT] in /branches/REL_2/saml/saml2/core: Assertions.h impl/Assertions.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Fri Mar  2 18:13:03 2012
New Revision: 717

URL: http://svn.shibboleth.net/view/cpp-opensaml?rev=717&view=rev
Log:
Add option to reject unauthenticated ciphers

Modified:
    branches/REL_2/saml/saml2/core/Assertions.h
    branches/REL_2/saml/saml2/core/impl/Assertions.cpp

Modified: branches/REL_2/saml/saml2/core/Assertions.h
URL: http://svn.shibboleth.net/view/cpp-opensaml/branches/REL_2/saml/saml2/core/Assertions.h?rev=717&r1=716&r2=717&view=diff
==============================================================================
--- branches/REL_2/saml/saml2/core/Assertions.h (original)
+++ branches/REL_2/saml/saml2/core/Assertions.h Fri Mar  2 18:13:03 2012
@@ -133,13 +133,23 @@
              * <p>The object returned will be unmarshalled around the decrypted DOM element in a
              * new Document owned by the object.
              *
+             * <p>The final boolean parameter is used to enforce a requirement for an authenticated cipher
+             * suite such as AES-GCM or similar. These ciphers include an HMAC or equivalent step that
+             * prevents tampering. Newer applications should set this parameter to true unless the ciphertext
+             * has been independently authenticated, and even in such a case, it is rarely possible to prevent
+             * chosen ciphertext attacks by trusted signers.
+             *
              * @param credResolver  locked resolver supplying decryption keys
              * @param recipient     identifier naming the recipient (the entity performing the decryption)
              * @param criteria      optional external criteria to use with resolver
+             * @param requireAuthenticatedCipher    true iff the bulk data encryption algorithm must be an authenticated cipher
              * @return  the decrypted and unmarshalled object
              */
             virtual xmltooling::XMLObject* decrypt(
-                const xmltooling::CredentialResolver& credResolver, const XMLCh* recipient, xmltooling::CredentialCriteria* criteria=nullptr
+                const xmltooling::CredentialResolver& credResolver,
+                const XMLCh* recipient,
+                xmltooling::CredentialCriteria* criteria=nullptr,
+                bool requireAuthenticatedCipher=false
                 ) const;
         END_XMLOBJECT;
 

Modified: branches/REL_2/saml/saml2/core/impl/Assertions.cpp
URL: http://svn.shibboleth.net/view/cpp-opensaml/branches/REL_2/saml/saml2/core/impl/Assertions.cpp?rev=717&r1=716&r2=717&view=diff
==============================================================================
--- branches/REL_2/saml/saml2/core/impl/Assertions.cpp (original)
+++ branches/REL_2/saml/saml2/core/impl/Assertions.cpp Fri Mar  2 18:13:03 2012
@@ -241,12 +241,14 @@
     }
 }
 
-XMLObject* EncryptedElementType::decrypt(const CredentialResolver& credResolver, const XMLCh* recipient, CredentialCriteria* criteria) const
+XMLObject* EncryptedElementType::decrypt(
+    const CredentialResolver& credResolver, const XMLCh* recipient, CredentialCriteria* criteria, bool requireAuthenticatedCipher
+    ) const
 {
     if (!getEncryptedData())
         throw DecryptionException("No encrypted data present.");
     opensaml::EncryptedKeyResolver ekr(*this);
-    Decrypter decrypter(&credResolver, criteria, &ekr);
+    Decrypter decrypter(&credResolver, criteria, &ekr, requireAuthenticatedCipher);
     DOMDocumentFragment* frag = decrypter.decryptData(*getEncryptedData(), recipient);
     if (frag->hasChildNodes() && frag->getFirstChild()==frag->getLastChild()) {
         DOMNode* plaintext=frag->getFirstChild();