[java-opensaml] branch main updated: Remove all direct usage of commons-codec from OpenSAML.

Codeberg noreply at shibboleth.net
Thu Oct 22 16:56:57 UTC 2026


This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-opensaml.

View the commit online:
https://codeberg.org/Shibboleth/java-opensaml/commit/659d3a0492d6e00848d78cc4a5711691384bde54

The following commit(s) were added to refs/heads/main by this push:
     new 659d3a049 Remove all direct usage of commons-codec from OpenSAML.
659d3a049 is described below

commit 659d3a0492d6e00848d78cc4a5711691384bde54
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Thu Oct 22 12:56:47 2026 -0400

    Remove all direct usage of commons-codec from OpenSAML.
---
 opensaml-core-api/pom.xml                          |   5 -
 .../opensaml/core/xml/util/XMLObjectSource.java    |   4 +-
 opensaml-saml-api/pom.xml                          |   5 -
 .../binding/artifact/AbstractSAMLArtifact.java     |   4 +-
 .../opensaml/saml/criterion/ArtifactCriterion.java |   4 +-
 opensaml-saml-impl/pom.xml                         |   5 -
 .../index/impl/SAMLArtifactMetadataIndex.java      |  10 +-
 .../index/impl/SAMLArtifactMetadataIndexTest.java  |   8 +-
 opensaml-security-api/pom.xml                      |   5 -
 .../org/opensaml/security/crypto/SigningUtil.java  |   6 +-
 .../security/x509/X509DigestCriterion.java         |   5 +-
 .../x509/X509SubjectKeyIdentifierCriterion.java    |   5 +-
 .../opensaml/security/x509/X509SupportTest.java    |  11 +-
 opensaml-security-impl/pom.xml                     |   5 -
 .../EvaluableX509DigestCredentialCriterion.java    |   4 +-
 ...509SubjectKeyIdentifierCredentialCriterion.java |   4 +-
 opensaml-spring/pom.xml                            |   5 -
 .../AbstractBasicCredentialFactoryBean.java        |  64 +++++-----
 .../BasicInlineCredentialFactoryBean.java          |   6 +-
 opensaml-xmlsec-impl/pom.xml                       |   4 -
 .../opensaml/xmlsec/derivation/impl/ConcatKDF.java |   8 +-
 .../xmlsec/derivation/impl/DHLegacyKDF.java        |   6 +-
 .../encryption/impl/ConcatKDFParamsImpl.java       |  34 ++---
 .../xmlsec/derivation/impl/ConcatKDFTest.java      | 142 ++++++++++-----------
 .../xmlsec/derivation/impl/DHLegacyKDFTest.java    |  34 ++---
 .../xmlsec/derivation/impl/PBKDF2Test.java         |  42 +++---
 26 files changed, 203 insertions(+), 232 deletions(-)

diff --git a/opensaml-core-api/pom.xml b/opensaml-core-api/pom.xml
index 1b10c4768..73be6c312 100644
--- a/opensaml-core-api/pom.xml
+++ b/opensaml-core-api/pom.xml
@@ -21,11 +21,6 @@
 
     <dependencies>
         <!-- Compile Dependencies -->
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-
         <dependency>
        	    <groupId>com.google.guava</groupId>
        	    <artifactId>guava</artifactId>
diff --git a/opensaml-core-api/src/main/java/org/opensaml/core/xml/util/XMLObjectSource.java b/opensaml-core-api/src/main/java/org/opensaml/core/xml/util/XMLObjectSource.java
index b356b355f..7b065f314 100644
--- a/opensaml-core-api/src/main/java/org/opensaml/core/xml/util/XMLObjectSource.java
+++ b/opensaml-core-api/src/main/java/org/opensaml/core/xml/util/XMLObjectSource.java
@@ -18,13 +18,13 @@ import java.util.Arrays;
 
 import javax.annotation.Nonnull;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 
 import com.google.common.base.MoreObjects;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -75,7 +75,7 @@ public class XMLObjectSource {
     @Override
     public String toString() {
         return MoreObjects.toStringHelper(this)
-                .add("source", new String(Hex.encodeHex(source, true)))
+                .add("source", HexSupport.encodeLowerCase(source))
                 .toString();
     }
 
diff --git a/opensaml-saml-api/pom.xml b/opensaml-saml-api/pom.xml
index c8181206a..0106001b4 100644
--- a/opensaml-saml-api/pom.xml
+++ b/opensaml-saml-api/pom.xml
@@ -66,11 +66,6 @@
             <artifactId>shib-security</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-
         <dependency>
         	<groupId>com.google.guava</groupId>
         	<artifactId>guava</artifactId>
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/AbstractSAMLArtifact.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/AbstractSAMLArtifact.java
index 6c2e63d5d..86eeee8d0 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/AbstractSAMLArtifact.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/AbstractSAMLArtifact.java
@@ -21,10 +21,10 @@ import javax.annotation.Nonnull;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.EncodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
-import org.apache.commons.codec.binary.Hex;
 import org.slf4j.Logger;
 
 /**
@@ -100,7 +100,7 @@ public abstract class AbstractSAMLArtifact implements SAMLArtifact {
      * @return hex encoded artifact
      */
     @Nonnull @NotEmpty public String hexEncode() {
-        return Hex.encodeHexString(getArtifactBytes());
+        return HexSupport.encodeLowerCase(getArtifactBytes());
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java
index baca7fb15..4f92fa795 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java
@@ -18,9 +18,9 @@ import java.util.Objects;
 
 import javax.annotation.Nonnull;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.saml.common.binding.artifact.SAMLArtifact;
 
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.Criterion;
 
@@ -53,7 +53,7 @@ public final class ArtifactCriterion implements Criterion {
     public String toString() {
         final StringBuilder builder = new StringBuilder();
         builder.append("ArtifactCriterion [artifact=");
-        builder.append(Hex.encodeHex(artifact.getArtifactBytes(), true));
+        builder.append(HexSupport.encodeLowerCase(artifact.getArtifactBytes()));
         builder.append("]");
         return builder.toString();
     }
diff --git a/opensaml-saml-impl/pom.xml b/opensaml-saml-impl/pom.xml
index c0ab2f441..0b584a760 100644
--- a/opensaml-saml-impl/pom.xml
+++ b/opensaml-saml-impl/pom.xml
@@ -106,11 +106,6 @@
             <artifactId>shib-velocity</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-
         <dependency>
         	<groupId>com.google.guava</groupId>
         	<artifactId>guava</artifactId>
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
index 05046e830..7d02db3e7 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
@@ -28,8 +28,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.common.binding.artifact.SAMLArtifact;
 import org.opensaml.saml.common.binding.artifact.SAMLSourceIDArtifact;
@@ -51,6 +49,8 @@ import com.google.common.base.MoreObjects;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.logic.Constraint;
@@ -211,14 +211,14 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
                             final String extSourceIDHex = StringSupport.trimOrNull(extSourceID.getValue());
                             if (extSourceIDHex != null) {
                                 try {
-                                    final byte[] sourceID = Hex.decodeHex(extSourceIDHex.toCharArray());
+                                    final byte[] sourceID = HexSupport.decode(extSourceIDHex);
                                     assert sourceID != null;
                                     final ArtifactSourceIDMetadataIndexKey key = 
                                             new ArtifactSourceIDMetadataIndexKey(sourceID);
                                     log.trace("For SourceID extension value '{}' produced index key: {}", 
                                             extSourceIDHex, key);
                                     results.add(key);
-                                } catch (final DecoderException e) {
+                                } catch (final DecodingException e) {
                                     log.warn("Error decoding hexidecimal SourceID extension value '{}' for indexing", 
                                             extSourceIDHex, e);
                                 }
@@ -311,7 +311,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
         @Override
         public String toString() {
             return MoreObjects.toStringHelper(this)
-                    .add("sourceID", new String(Hex.encodeHex(sourceID, true)))
+                    .add("sourceID", HexSupport.encodeLowerCase(sourceID))
                     .toString();
         }
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndexTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndexTest.java
index 656ea777f..2c8983612 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndexTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndexTest.java
@@ -20,7 +20,6 @@ import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.Set;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.saml.common.binding.artifact.SAMLSourceIDArtifact;
@@ -44,6 +43,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 @SuppressWarnings("javadoc")
@@ -96,19 +96,19 @@ public class SAMLArtifactMetadataIndexTest extends XMLObjectBaseTestCase {
         secureRandom.nextBytes(secondarySourceID);
         extSourceIDKey1a = new ArtifactSourceIDMetadataIndexKey(secondarySourceID);
         extSourceID1a = buildXMLObject(SourceID.DEFAULT_ELEMENT_NAME);
-        extSourceID1a.setValue(new String(Hex.encodeHex(secondarySourceID, true)));
+        extSourceID1a.setValue(HexSupport.encodeLowerCase(secondarySourceID));
         
         secondarySourceID = new byte[20];
         secureRandom.nextBytes(secondarySourceID);
         extSourceIDKey1b = new ArtifactSourceIDMetadataIndexKey(secondarySourceID);
         extSourceID1b = buildXMLObject(SourceID.DEFAULT_ELEMENT_NAME);
-        extSourceID1b.setValue(new String(Hex.encodeHex(secondarySourceID, true)));
+        extSourceID1b.setValue(HexSupport.encodeLowerCase(secondarySourceID));
         
         secondarySourceID = new byte[20];
         secureRandom.nextBytes(secondarySourceID);
         extSourceIDKey2 = new ArtifactSourceIDMetadataIndexKey(secondarySourceID);
         extSourceID2 = buildXMLObject(SourceID.DEFAULT_ELEMENT_NAME);
-        extSourceID2.setValue(new String(Hex.encodeHex(secondarySourceID, true)));
+        extSourceID2.setValue(HexSupport.encodeLowerCase(secondarySourceID));
     }
     
     @Test
diff --git a/opensaml-security-api/pom.xml b/opensaml-security-api/pom.xml
index c2b0d9a48..42e892f4c 100644
--- a/opensaml-security-api/pom.xml
+++ b/opensaml-security-api/pom.xml
@@ -41,11 +41,6 @@
             <groupId>${shib-shared.groupId}</groupId>
             <artifactId>shib-security</artifactId>
         </dependency>
-        
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
 
         <dependency>
         	<groupId>com.google.guava</groupId>
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java
index 6c1298a49..76a85ff56 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java
@@ -24,12 +24,12 @@ import java.util.Arrays;
 import javax.annotation.Nonnull;
 import javax.crypto.Mac;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -105,7 +105,7 @@ public final class SigningUtil {
             signature.initSign(signingKey);
             signature.update(input);
             final byte[] rawSignature = signature.sign();
-            LOG.debug("Computed signature: {}", Hex.encodeHex(rawSignature));
+            LOG.debug("Computed signature: {}", HexSupport.encodeLowerCase(rawSignature));
             return rawSignature;
         } catch (final GeneralSecurityException e) {
             LOG.error("Error during signature generation: {}", e.getMessage());
@@ -139,7 +139,7 @@ public final class SigningUtil {
             mac.init(signingKey);
             mac.update(input);
             final byte[] rawMAC = mac.doFinal();
-            LOG.debug("Computed MAC: {}", Hex.encodeHexString(rawMAC));
+            LOG.debug("Computed MAC: {}", HexSupport.encodeLowerCase(rawMAC));
             return rawMAC;
         } catch (final GeneralSecurityException e) {
             LOG.error("Error during MAC generation: {}", e.getMessage());
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java
index 8bd008aa3..2ca29df8f 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java
@@ -18,12 +18,11 @@ import java.util.Arrays;
 
 import javax.annotation.Nonnull;
 
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.resolver.Criterion;
 
-import org.apache.commons.codec.binary.Hex;
-
 /**
  * An implementation of {@link Criterion} which specifies criteria based on
  * the digest of an X.509 certificate.
@@ -91,7 +90,7 @@ public final class X509DigestCriterion implements Criterion {
         builder.append("X509DigestCriterion [algorithm=");
         builder.append(algorithm);
         builder.append(", digest=");
-        builder.append(Hex.encodeHexString(x509digest));
+        builder.append(HexSupport.encodeLowerCase(x509digest));
         builder.append("]");
         return builder.toString();
     }
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
index 85b40866a..8dabe2be6 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
@@ -16,8 +16,7 @@ package org.opensaml.security.x509;
 
 import javax.annotation.Nonnull;
 
-import org.apache.commons.codec.binary.Hex;
-
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.resolver.Criterion;
 
 /**
@@ -66,7 +65,7 @@ public final class X509SubjectKeyIdentifierCriterion implements Criterion {
     public String toString() {
         final StringBuilder builder = new StringBuilder();
         builder.append("X509SubjectKeyIdentifierCriterion [subjectKeyIdentifier=");
-        builder.append(Hex.encodeHexString(subjectKeyIdentifier));
+        builder.append(HexSupport.encodeLowerCase(subjectKeyIdentifier));
         builder.append("]");
         return builder.toString();
     }
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
index e48b29ab1..4e295c8e3 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
@@ -30,8 +30,6 @@ import java.util.Set;
 
 import javax.security.auth.x500.X500Principal;
 
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.crypto.KeySupportTest;
@@ -39,6 +37,9 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.codec.HexSupport;
+
 /**
  * Tests the X509Support utility methods.
  */
@@ -356,13 +357,13 @@ public class X509SupportTest {
     /**
      * Test Subject Key Identifier (SKI) extraction from certificate.
      * 
-     * @throws DecoderException ...
+     * @throws DecodingException
      */
     @Test
-    public void testGetSubjectKeyIdentifier() throws DecoderException {
+    public void testGetSubjectKeyIdentifier() throws DecodingException {
         // This is the cert SKI according to OpenSSL 'openssl x509 -in entity.crt -noout -text'
         String hexSKI = "D2:57:F5:C1:8C:11:26:1B:C6:65:82:F6:5A:93:0E:CA:40:CD:75:E5";
-        byte[] controlSKI = Hex.decodeHex(hexSKI.replaceAll(":", "").toCharArray());
+        byte[] controlSKI = HexSupport.decode(hexSKI.replaceAll(":", ""));
         byte[] certSKI = X509Support.getSubjectKeyIdentifier(entityCert);
         Assert.assertEquals(certSKI, controlSKI);
     }
diff --git a/opensaml-security-impl/pom.xml b/opensaml-security-impl/pom.xml
index 2edbe343c..535b45fb6 100644
--- a/opensaml-security-impl/pom.xml
+++ b/opensaml-security-impl/pom.xml
@@ -44,11 +44,6 @@
             <artifactId>shib-networking</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-
         <dependency>
         	<groupId>com.google.guava</groupId>
         	<artifactId>guava</artifactId>
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
index 82a2eb649..3467c7d0f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
@@ -24,12 +24,12 @@ import java.util.Arrays;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509DigestCriterion;
@@ -105,7 +105,7 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
         builder.append("EvaluableX509DigestCredentialCriterion [algorithm=");
         builder.append(algorithm);
         builder.append(", x509digest=");
-        builder.append(Hex.encodeHexString(x509digest));
+        builder.append(HexSupport.encodeLowerCase(x509digest));
         builder.append("]");
         return builder.toString();
     }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
index f9357f74e..297401042 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
@@ -20,11 +20,11 @@ import java.util.Arrays;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509SubjectKeyIdentifierCriterion;
@@ -89,7 +89,7 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
     public String toString() {
         final StringBuilder builder = new StringBuilder();
         builder.append("EvaluableX509SubjectKeyIdentifierCredentialCriterion [ski=");
-        builder.append(Hex.encodeHexString(ski));
+        builder.append(HexSupport.encodeLowerCase(ski));
         builder.append("]");
         return builder.toString();
     }
diff --git a/opensaml-spring/pom.xml b/opensaml-spring/pom.xml
index a8604936f..618bdb68f 100644
--- a/opensaml-spring/pom.xml
+++ b/opensaml-spring/pom.xml
@@ -73,11 +73,6 @@
             <artifactId>bcprov-jdk18on</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-
         <dependency>
             <groupId>${httpclient.groupId}</groupId>
             <artifactId>${httpclient.artifactId}</artifactId>
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java
index 0efe261e5..3816b2bb9 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java
@@ -14,7 +14,7 @@
 
 package org.opensaml.spring.credential;
 
-import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
 import java.security.PrivateKey;
 import java.security.PublicKey;
 
@@ -22,12 +22,13 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
+import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
-import org.apache.commons.codec.binary.Base64;
-import org.bouncycastle.util.encoders.Hex;
 import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.crypto.KeySupport;
@@ -65,24 +66,22 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
      * @param data the Secret key data
      * @return the decoded SecretKey byte array
      */
-    @Nonnull protected byte[] decodeSecretKey(final String data) {
+    @Nonnull protected byte[] decodeSecretKey(@Nonnull final String data) {
         Constraint.isNotNull(data, "SecretKey data was null");
-        switch (getSecretKeyEncoding()) {
-            case binary:
-                // This sort of doesn't make sense for the String input, but just assume it's UTF-8
-                try {
-                    return data.getBytes("UTF-8");
-                } catch (final UnsupportedEncodingException e) {
-                    // Can't actually happen, UTF-8 always supported.
-                    throw new UnsupportedOperationException(e);
-                }
-            case hex:
-                return Hex.decode(data);
-            case base64:
-                return Base64.decodeBase64(data);
-            default:
-                throw new IllegalArgumentException("Saw unsupported encoding: " + getSecretKeyEncoding());
-            
+        try {
+            switch (getSecretKeyEncoding()) {
+                case binary:
+                    // This sort of doesn't make sense for the String input, but just assume it's UTF-8
+                    return data.getBytes(StandardCharsets.UTF_8);
+                case hex:
+                    return HexSupport.decode(data);
+                case base64:
+                    return Base64Support.decode(data);
+                default:
+                    throw new IllegalArgumentException("Saw unsupported encoding: " + getSecretKeyEncoding());
+            }
+        } catch (final DecodingException e) {
+            throw new IllegalArgumentException("Failed to decode via " + getSecretKeyEncoding(), e);
         }
     }
 
@@ -92,18 +91,21 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
      * @param data the Secret key data
      * @return the decoded SecretKey byte array
      */
-    @Nonnull protected byte[] decodeSecretKey(final byte[] data) {
+    @Nonnull protected byte[] decodeSecretKey(@Nonnull final byte[] data) {
         Constraint.isNotNull(data, "SecretKey data was null");
-        switch (getSecretKeyEncoding()) {
-            case binary:
-                return data;
-            case hex:
-                return Hex.decode(data);
-            case base64:
-                return Base64.decodeBase64(data);
-            default:
-                throw new IllegalArgumentException("Saw unsupported encoding: " + getSecretKeyEncoding());
-            
+        try {
+            switch (getSecretKeyEncoding()) {
+                case binary:
+                    return data;
+                case hex:
+                    return HexSupport.decode(new String(data, StandardCharsets.UTF_8));
+                case base64:
+                    return Base64Support.decode(new String(data, StandardCharsets.UTF_8));
+                default:
+                    throw new IllegalArgumentException("Saw unsupported encoding: " + getSecretKeyEncoding());
+            }
+        } catch (final DecodingException e) {
+            throw new IllegalArgumentException("Failed to decode via " + getSecretKeyEncoding(), e);
         }
     }
 
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java
index ca1111f22..5eb416980 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java
@@ -119,7 +119,11 @@ public class BasicInlineCredentialFactoryBean extends AbstractBasicCredentialFac
             if (alg == null) {
                 throw new KeyException("Key algorithm was null");
             }
-            return KeySupport.decodeSecretKey(decodeSecretKey(getSecretKeyInfo()), alg);
+            final byte[] data = getSecretKeyInfo();
+            if (data == null) {
+                throw new KeyException("Secret key data was null");
+            }
+            return KeySupport.decodeSecretKey(decodeSecretKey(data), alg);
         } catch (final KeyException e) {
             throw new BeanCreationException("Could not decode secret key", e);
         }
diff --git a/opensaml-xmlsec-impl/pom.xml b/opensaml-xmlsec-impl/pom.xml
index e4604b103..dd55de53b 100644
--- a/opensaml-xmlsec-impl/pom.xml
+++ b/opensaml-xmlsec-impl/pom.xml
@@ -56,10 +56,6 @@
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
         </dependency>
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.santuario</groupId>
             <artifactId>xmlsec</artifactId>
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
index 681387d32..8e1790bc7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
@@ -19,8 +19,6 @@ import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
 
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
 import org.bouncycastle.crypto.Digest;
 import org.bouncycastle.crypto.agreement.kdf.ConcatenationKDFGenerator;
 import org.bouncycastle.crypto.digests.RIPEMD160Digest;
@@ -53,6 +51,8 @@ import com.google.common.primitives.Bytes;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -378,8 +378,8 @@ public class ConcatKDF extends AbstractInitializableComponent
         
         byte[] decoded = null;
         try {
-            decoded = Hex.decodeHex(trimmed);
-        } catch (final DecoderException e) {
+            decoded = HexSupport.decode(trimmed);
+        } catch (final DecodingException e) {
             throw new KeyDerivationException("ConcatKDF parameter was not valid hex-encoded value: " + name, e);
         }
         assert decoded!=null;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java
index 985f642c7..ac2725de0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java
@@ -23,7 +23,6 @@ import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.opensaml.xmlsec.derivation.KeyDerivationException;
 import org.opensaml.xmlsec.derivation.KeyDerivationSupport;
@@ -34,6 +33,7 @@ import com.google.common.primitives.Bytes;
 
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -181,12 +181,12 @@ public class DHLegacyKDF {
                 nonceBytes,
                 keyLength.toString().getBytes(Charsets.UTF_8));
         
-        log.trace("Digest input for counter={} in hex was: {}", counter, Hex.encodeHexString(digestInput, false));
+        log.trace("Digest input for counter={} in hex was: {}", counter, HexSupport.encodeUpperCase(digestInput));
         
         try {
             final MessageDigest md = MessageDigest.getInstance(digestAlgorithm);
             final byte[] output = md.digest(digestInput);
-            log.trace("Digest output for counter={} in hex was: {}", counter, Hex.encodeHexString(output, false));
+            log.trace("Digest output for counter={} in hex was: {}", counter, HexSupport.encodeUpperCase(output));
             return output;
         } catch (final NoSuchAlgorithmException e) {
             throw new KeyDerivationException("Fatal error computing digest for key derivation", e);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
index 1f60a48c2..d670140b4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
@@ -20,14 +20,14 @@ import java.util.List;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.XMLRuntimeException;
 import org.opensaml.xmlsec.encryption.ConcatKDFParams;
 import org.opensaml.xmlsec.signature.DigestMethod;
 
+import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
@@ -88,15 +88,15 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
     /** {@inheritDoc} */
     @Nullable public byte[] getAlgorithmIDBytes() {
         try {
-            return algorithmID == null ? null : Hex.decodeHex(algorithmID);
-        } catch (final DecoderException e) {
+            return algorithmID == null ? null : HexSupport.decode(algorithmID);
+        } catch (final DecodingException e) {
             throw new XMLRuntimeException(e);
         }
     }
 
     /** {@inheritDoc} */
     public void setAlgorithmIDBytes(@Nullable final byte[] newAlgorithmID) {
-        setAlgorithmID(newAlgorithmID == null ? null : Hex.encodeHexString(newAlgorithmID, false));
+        setAlgorithmID(newAlgorithmID == null ? null : HexSupport.encodeUpperCase(newAlgorithmID));
     }
 
     /** {@inheritDoc} */
@@ -112,15 +112,15 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
     /** {@inheritDoc} */
     @Nullable public byte[] getPartyUInfoBytes() {
         try {
-            return partyUInfo == null ? null : Hex.decodeHex(partyUInfo);
-        } catch (final DecoderException e) {
+            return partyUInfo == null ? null : HexSupport.decode(partyUInfo);
+        } catch (final DecodingException e) {
             throw new XMLRuntimeException(e);
         }
     }
 
     /** {@inheritDoc} */
     public void setPartyUInfoBytes(@Nullable final byte[] newPartyUInfo) {
-        setPartyUInfo(newPartyUInfo == null ? null : Hex.encodeHexString(newPartyUInfo, false));
+        setPartyUInfo(newPartyUInfo == null ? null : HexSupport.encodeUpperCase(newPartyUInfo));
     }
 
     /** {@inheritDoc} */
@@ -136,15 +136,15 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
     /** {@inheritDoc} */
     @Nullable public byte[] getPartyVInfoBytes() {
         try {
-            return partyVInfo == null ? null : Hex.decodeHex(partyVInfo);
-        } catch (final DecoderException e) {
+            return partyVInfo == null ? null : HexSupport.decode(partyVInfo);
+        } catch (final DecodingException e) {
             throw new XMLRuntimeException(e);
         }
     }
 
     /** {@inheritDoc} */
     public void setPartyVInfoBytes(@Nullable final byte[] newPartyVInfo) {
-        setPartyVInfo(newPartyVInfo == null ? null : Hex.encodeHexString(newPartyVInfo, false));
+        setPartyVInfo(newPartyVInfo == null ? null : HexSupport.encodeUpperCase(newPartyVInfo));
     }
 
     /** {@inheritDoc} */
@@ -160,15 +160,15 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
     /** {@inheritDoc} */
     @Nullable public byte[] getSuppPubInfoBytes() {
         try {
-            return suppPubInfo == null ? null : Hex.decodeHex(suppPubInfo);
-        } catch (final DecoderException e) {
+            return suppPubInfo == null ? null : HexSupport.decode(suppPubInfo);
+        } catch (final DecodingException e) {
             throw new XMLRuntimeException(e);
         }
     }
 
     /** {@inheritDoc} */
     public void setSuppPubInfoBytes(@Nullable final byte[] newSuppPubInfo) {
-        setSuppPubInfo(newSuppPubInfo == null ? null : Hex.encodeHexString(newSuppPubInfo, false));
+        setSuppPubInfo(newSuppPubInfo == null ? null : HexSupport.encodeUpperCase(newSuppPubInfo));
     }
 
     /** {@inheritDoc} */
@@ -184,15 +184,15 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
     /** {@inheritDoc} */
     @Nullable public byte[] getSuppPrivInfoBytes() {
         try {
-            return suppPrivInfo == null ? null : Hex.decodeHex(suppPrivInfo);
-        } catch (final DecoderException e) {
+            return suppPrivInfo == null ? null : HexSupport.decode(suppPrivInfo);
+        } catch (final DecodingException e) {
             throw new XMLRuntimeException(e);
         }
     }
 
     /** {@inheritDoc} */
     public void setSuppPrivInfoBytes(@Nullable final byte[] newSuppPrivInfo) {
-        setSuppPrivInfo(newSuppPrivInfo == null ? null : Hex.encodeHexString(newSuppPrivInfo, false));
+        setSuppPrivInfo(newSuppPrivInfo == null ? null : HexSupport.encodeUpperCase(newSuppPrivInfo));
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java
index 3e42de135..3ecc0c50d 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java
@@ -16,8 +16,6 @@ package org.opensaml.xmlsec.derivation.impl;
 
 import javax.crypto.SecretKey;
 
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -31,7 +29,9 @@ import org.testng.Assert;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.codec.EncodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 
 @SuppressWarnings({"javadoc", "null"})
@@ -384,7 +384,7 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
         ConcatKDF kdf = new ConcatKDF();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         SecretKey derivedKey = kdf.derive(secret, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, null);
         
@@ -403,7 +403,7 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
         kdf.setSuppPrivInfo("EE");
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         SecretKey derivedKey = kdf.derive(secret, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, null);
         
@@ -417,7 +417,7 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
         ConcatKDF kdf = new ConcatKDF();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         kdf.derive(secret, "urn:test:InvalidKeyAlgorithm", null);
     }
@@ -427,7 +427,7 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
         ConcatKDF kdf = new ConcatKDF();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         // Just use this as a stand-in for something which is KeySpecifiedAlgorithm but not KeyLengthSpecifiedAlgorithm
         kdf.derive(secret, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, null);
@@ -438,7 +438,7 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
         ConcatKDF kdf = new ConcatKDF();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         // Just use this as a stand-in for something which is KeySpecifiedAlgorithm but not KeyLengthSpecifiedAlgorithm
         SecretKey derivedKey = kdf.derive(secret, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, 256);
@@ -537,7 +537,7 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
     //
 
     @DataProvider(name = "testVectors")
-    public Object[][] testVectors() throws DecoderException, EncodingException {
+    public Object[][] testVectors() throws DecodingException, EncodingException {
         return new Object[][] {
             
             // Non-normative vectors.
@@ -547,153 +547,153 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
             
             // SHA-1 digest
             new Object[] {
-                    Hex.decodeHex("d09a6b1a472f930db4f5e6b967900744"),
-                    Hex.decodeHex("b117255ab5f1b6b96fc434b0"),
+                    HexSupport.decode("d09a6b1a472f930db4f5e6b967900744"),
+                    HexSupport.decode("b117255ab5f1b6b96fc434b0"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("b5a3c52e97ae6e8c5069954354eab3c7")},
+                    HexSupport.decode("b5a3c52e97ae6e8c5069954354eab3c7")},
             
             new Object[] {
-                    Hex.decodeHex("343666c0dd34b756e70f759f14c304f5"),
-                    Hex.decodeHex("722b28448d7eab85491bce09"),
+                    HexSupport.decode("343666c0dd34b756e70f759f14c304f5"),
+                    HexSupport.decode("722b28448d7eab85491bce09"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("1003b650ddd3f0891a15166db5ec881d")},
+                    HexSupport.decode("1003b650ddd3f0891a15166db5ec881d")},
             
             new Object[] {
-                    Hex.decodeHex("b84acf03ab08652dd7f82fa956933261"),
-                    Hex.decodeHex("3d8773ec068c86053a918565"),
+                    HexSupport.decode("b84acf03ab08652dd7f82fa956933261"),
+                    HexSupport.decode("3d8773ec068c86053a918565"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("1635dcd1ce698f736831b4badb68ab2b")},
+                    HexSupport.decode("1635dcd1ce698f736831b4badb68ab2b")},
             
             new Object[] {
-                    Hex.decodeHex("8cc24ca3f1d1a8b34783780b79890430"),
-                    Hex.decodeHex("f08d4f2d9a8e6d7105c0bc16"),
+                    HexSupport.decode("8cc24ca3f1d1a8b34783780b79890430"),
+                    HexSupport.decode("f08d4f2d9a8e6d7105c0bc16"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("b8e716fb84a420aed4812cd76d9700ee")},
+                    HexSupport.decode("b8e716fb84a420aed4812cd76d9700ee")},
             
             new Object[] {
-                    Hex.decodeHex("ebe28edbae5a410b87a479243db3f690"),
-                    Hex.decodeHex("e60dd8b28228ce5b9be74d3b"),
+                    HexSupport.decode("ebe28edbae5a410b87a479243db3f690"),
+                    HexSupport.decode("e60dd8b28228ce5b9be74d3b"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("b4a23963e07f485382cb358a493daec1")},
+                    HexSupport.decode("b4a23963e07f485382cb358a493daec1")},
             
             new Object[] {
-                    Hex.decodeHex("ebe28edbae5a410b87a479243db3f690"),
-                    Hex.decodeHex("e60dd8b28228ce5b9be74d3b"),
+                    HexSupport.decode("ebe28edbae5a410b87a479243db3f690"),
+                    HexSupport.decode("e60dd8b28228ce5b9be74d3b"),
                     192,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("b4a23963e07f485382cb358a493daec1759ac7043dbeac37")},
+                    HexSupport.decode("b4a23963e07f485382cb358a493daec1759ac7043dbeac37")},
             
             new Object[] {
-                    Hex.decodeHex("ebe28edbae5a410b87a479243db3f690"),
-                    Hex.decodeHex("e60dd8b28228ce5b9be74d3b"),
+                    HexSupport.decode("ebe28edbae5a410b87a479243db3f690"),
+                    HexSupport.decode("e60dd8b28228ce5b9be74d3b"),
                     256,
                     SignatureConstants.ALGO_ID_DIGEST_SHA1,
-                    Hex.decodeHex("b4a23963e07f485382cb358a493daec1759ac7043dbeac37152c6ddf105031f0")},
+                    HexSupport.decode("b4a23963e07f485382cb358a493daec1759ac7043dbeac37152c6ddf105031f0")},
 
             // SHA-256 digest
             new Object[] {
-                    Hex.decodeHex("afc4e154498d4770aa8365f6903dc83b"),
-                    Hex.decodeHex("662af20379b29d5ef813e655"),
+                    HexSupport.decode("afc4e154498d4770aa8365f6903dc83b"),
+                    HexSupport.decode("662af20379b29d5ef813e655"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("f0b80d6ae4c1e19e2105a37024e35dc6")},
+                    HexSupport.decode("f0b80d6ae4c1e19e2105a37024e35dc6")},
             
             new Object[] {
-                    Hex.decodeHex("a3ce8d61d699ad150e196a7ab6736a63"),
-                    Hex.decodeHex("ce5cd95a44ee83a8fb83f34c"),
+                    HexSupport.decode("a3ce8d61d699ad150e196a7ab6736a63"),
+                    HexSupport.decode("ce5cd95a44ee83a8fb83f34c"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("5db3455a22b65edfcfde3da3e8d724cd")},
+                    HexSupport.decode("5db3455a22b65edfcfde3da3e8d724cd")},
             
             new Object[] {
-                    Hex.decodeHex("a9723e56045f0847fdd9c1c78781c8b7"),
-                    Hex.decodeHex("e69b6005b78f7d42d0a8ed2a"),
+                    HexSupport.decode("a9723e56045f0847fdd9c1c78781c8b7"),
+                    HexSupport.decode("e69b6005b78f7d42d0a8ed2a"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("ac3878b8cf357976f7fd8266923e1882")},
+                    HexSupport.decode("ac3878b8cf357976f7fd8266923e1882")},
             
             new Object[] {
-                    Hex.decodeHex("a07a5e8df7ee1b2ce2a3d1348edfa8ab"),
-                    Hex.decodeHex("e22a8ee34296dd39b56b31fb"),
+                    HexSupport.decode("a07a5e8df7ee1b2ce2a3d1348edfa8ab"),
+                    HexSupport.decode("e22a8ee34296dd39b56b31fb"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("70927d218b6d119268381e9930a4f256")},
+                    HexSupport.decode("70927d218b6d119268381e9930a4f256")},
             
             new Object[] {
-                    Hex.decodeHex("3f892bd8b84dae64a782a35f6eaa8f00"),
-                    Hex.decodeHex("ec3f1cd873d28858a58cc39e"),
+                    HexSupport.decode("3f892bd8b84dae64a782a35f6eaa8f00"),
+                    HexSupport.decode("ec3f1cd873d28858a58cc39e"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("a7c0665298252531e0db37737a374651")},
+                    HexSupport.decode("a7c0665298252531e0db37737a374651")},
             
             new Object[] {
-                    Hex.decodeHex("3f892bd8b84dae64a782a35f6eaa8f00"),
-                    Hex.decodeHex("ec3f1cd873d28858a58cc39e"),
+                    HexSupport.decode("3f892bd8b84dae64a782a35f6eaa8f00"),
+                    HexSupport.decode("ec3f1cd873d28858a58cc39e"),
                     192,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("a7c0665298252531e0db37737a374651b368275f2048284d")},
+                    HexSupport.decode("a7c0665298252531e0db37737a374651b368275f2048284d")},
             
             new Object[] {
-                    Hex.decodeHex("3f892bd8b84dae64a782a35f6eaa8f00"),
-                    Hex.decodeHex("ec3f1cd873d28858a58cc39e"),
+                    HexSupport.decode("3f892bd8b84dae64a782a35f6eaa8f00"),
+                    HexSupport.decode("ec3f1cd873d28858a58cc39e"),
                     256,
                     SignatureConstants.ALGO_ID_DIGEST_SHA256,
-                    Hex.decodeHex("a7c0665298252531e0db37737a374651b368275f2048284d16a166c6d8a90a91")},
+                    HexSupport.decode("a7c0665298252531e0db37737a374651b368275f2048284d16a166c6d8a90a91")},
             
             // SHA-256 digest
             new Object[] {
-                    Hex.decodeHex("108cf63318555c787fa578731dd4f037"),
-                    Hex.decodeHex("53191b1dd3f94d83084d61d6"),
+                    HexSupport.decode("108cf63318555c787fa578731dd4f037"),
+                    HexSupport.decode("53191b1dd3f94d83084d61d6"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("0ad475c1826da3007637970c8b92b993")},
+                    HexSupport.decode("0ad475c1826da3007637970c8b92b993")},
             
             new Object[] {
-                    Hex.decodeHex("35fa6d42e65014f04bdd80ff1404ab27"),
-                    Hex.decodeHex("506d9cfe967748d1e6f84bd9"),
+                    HexSupport.decode("35fa6d42e65014f04bdd80ff1404ab27"),
+                    HexSupport.decode("506d9cfe967748d1e6f84bd9"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("16739821c3b13dee57e24c092211ddd6")},
+                    HexSupport.decode("16739821c3b13dee57e24c092211ddd6")},
             
             new Object[] {
-                    Hex.decodeHex("775e83546ce8b41a83656bd723d63c9e"),
-                    Hex.decodeHex("514f4d06bf8c1646aeae28fa"),
+                    HexSupport.decode("775e83546ce8b41a83656bd723d63c9e"),
+                    HexSupport.decode("514f4d06bf8c1646aeae28fa"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("0bce0e54a721367088495c0c4c0683f5")},
+                    HexSupport.decode("0bce0e54a721367088495c0c4c0683f5")},
             
             new Object[] {
-                    Hex.decodeHex("03f1dea7561b885a5601c6e75e405140"),
-                    Hex.decodeHex("1e366c4b697d20aa9a54d6f5"),
+                    HexSupport.decode("03f1dea7561b885a5601c6e75e405140"),
+                    HexSupport.decode("1e366c4b697d20aa9a54d6f5"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("56a2ac8f0eb55fdc4d8a891664edfbdb")},
+                    HexSupport.decode("56a2ac8f0eb55fdc4d8a891664edfbdb")},
             
             new Object[] {
-                    Hex.decodeHex("e65b1905878b95f68b5535bd3b2b1013"),
-                    Hex.decodeHex("830221b1730d9176f807d407"),
+                    HexSupport.decode("e65b1905878b95f68b5535bd3b2b1013"),
+                    HexSupport.decode("830221b1730d9176f807d407"),
                     128,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("b8c44bdf0b85a64b6a51c12a06710e37")},
+                    HexSupport.decode("b8c44bdf0b85a64b6a51c12a06710e37")},
             
             new Object[] {
-                    Hex.decodeHex("e65b1905878b95f68b5535bd3b2b1013"),
-                    Hex.decodeHex("830221b1730d9176f807d407"),
+                    HexSupport.decode("e65b1905878b95f68b5535bd3b2b1013"),
+                    HexSupport.decode("830221b1730d9176f807d407"),
                     192,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("b8c44bdf0b85a64b6a51c12a06710e373d829bb1fda5b4e1")},
+                    HexSupport.decode("b8c44bdf0b85a64b6a51c12a06710e373d829bb1fda5b4e1")},
             
             new Object[] {
-                    Hex.decodeHex("e65b1905878b95f68b5535bd3b2b1013"),
-                    Hex.decodeHex("830221b1730d9176f807d407"),
+                    HexSupport.decode("e65b1905878b95f68b5535bd3b2b1013"),
+                    HexSupport.decode("830221b1730d9176f807d407"),
                     256,
                     SignatureConstants.ALGO_ID_DIGEST_SHA512,
-                    Hex.decodeHex("b8c44bdf0b85a64b6a51c12a06710e373d829bb1fda5b4e1a20795c6199594f6")},
+                    HexSupport.decode("b8c44bdf0b85a64b6a51c12a06710e373d829bb1fda5b4e1a20795c6199594f6")},
             
             
         };
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java
index 8d4d947d4..34de197dc 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java
@@ -16,7 +16,6 @@ package org.opensaml.xmlsec.derivation.impl;
 
 import javax.crypto.SecretKey;
 
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.xmlsec.derivation.KeyDerivationException;
@@ -26,8 +25,9 @@ import org.testng.Assert;
 import org.testng.annotations.Test;
 
 import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.HexSupport;
 
- at SuppressWarnings({"javadoc", "null"})
+ at SuppressWarnings("javadoc")
 public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
     
     @Test
@@ -42,7 +42,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         byte[] digestCounter1 = kdf.digest(
                 1,
                 JCAConstants.DIGEST_SHA1,
-                Hex.decodeHex("DEADBEEF"),
+                HexSupport.decode("DEADBEEF"),
                 "Example:Block/Alg",
                 80,
                 Base64Support.decode(nonce));
@@ -50,10 +50,10 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         // The value in the original spec document Example 41 is incorrect, as indicated by the errata:
         // https://www.w3.org/2008/xmlsec/errata/xmlenc-core-11-errata.html
         // This is the correct value from the errata. (Yes, this wasted a lot of time...).
-        Assert.assertEquals(digestCounter1, Hex.decodeHex("59D9BA5E06072C1194091952B01B8360534AB11E"));
+        Assert.assertEquals(digestCounter1, HexSupport.decode("59D9BA5E06072C1194091952B01B8360534AB11E"));
        
         byte[] derived = kdf.deriveBytes(
-                Hex.decodeHex("DEADBEEF"),
+                HexSupport.decode("DEADBEEF"),
                 "Example:Block/Alg",
                 80);
         Assert.assertEquals(derived.length * 8, 80);
@@ -70,27 +70,27 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         
         SecretKey secretKey = null;
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, null);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, null);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 128);
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 128);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 128);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 128);
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192, null);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192, null);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 192);
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192, 192);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192, 192);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 192);
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, null);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, null);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 256);
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, 256);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, 256);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 256);
     }
@@ -102,7 +102,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         
         SecretKey secretKey = null;
         
-        secretKey = kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, null);
+        secretKey = kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, null);
         Assert.assertNotNull(secretKey);
         Assert.assertEquals(secretKey.getEncoded().length * 8, 128);
     }
@@ -112,7 +112,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         DHLegacyKDF kdf = new DHLegacyKDF(); 
         kdf.setNonce("Zm9v");
         
-        kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, null);
+        kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, null);
     }
         
     @Test(expectedExceptions=KeyDerivationException.class)
@@ -121,7 +121,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         kdf.setDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
         kdf.setNonce("Zm9v");
         
-        kdf.derive(Hex.decodeHex("DEADBEEF"), "urn:test:invalid", null);
+        kdf.derive(HexSupport.decode("DEADBEEF"), "urn:test:invalid", null);
     }
         
     @Test(expectedExceptions=KeyDerivationException.class)
@@ -130,7 +130,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         kdf.setDigestMethod("urn:test:invalid");
         kdf.setNonce("Zm9v");
         
-        kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 128);
+        kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 128);
     }
         
     @Test(expectedExceptions=KeyDerivationException.class)
@@ -139,7 +139,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         kdf.setDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
         kdf.setNonce("Zm9v");
         
-        kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 256);
+        kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 256);
     }
         
     @Test(expectedExceptions=KeyDerivationException.class)
@@ -148,7 +148,7 @@ public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
         kdf.setDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
         kdf.setNonce("INVALID!!!!@@$$##");
         
-        kdf.derive(Hex.decodeHex("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 128);
+        kdf.derive(HexSupport.decode("DEADBEEF"), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, 128);
     }
         
 }
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
index c20a244ab..0ec9801be 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
@@ -19,8 +19,6 @@ import java.security.SecureRandom;
 import javax.annotation.Nonnull;
 import javax.crypto.SecretKey;
 
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -46,7 +44,9 @@ import org.testng.annotations.Test;
 import com.google.common.base.Charsets;
 
 import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.codec.EncodingException;
+import net.shibboleth.shared.codec.HexSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 
 @SuppressWarnings({"javadoc", "null"})
@@ -276,7 +276,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         PBKDF2 kdf = new PBKDF2();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         SecretKey derivedKey = kdf.derive(secret, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, null);
         
@@ -303,7 +303,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         kdf.setSalt("ABCD");
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         SecretKey derivedKey = kdf.derive(secret, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM, null);
         
@@ -318,7 +318,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         kdf.setKeyLength(256);
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         kdf.derive(secret, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, null);
     }
@@ -328,7 +328,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         PBKDF2 kdf = new PBKDF2();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         kdf.derive(secret, "urn:test:InvalidKeyAlgorithm", null);
     }
@@ -338,7 +338,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         PBKDF2 kdf = new PBKDF2();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         // Just use this as a stand-in for something which is KeySpecifiedAlgorithm but not KeyLengthSpecifiedAlgorithm
         kdf.derive(secret, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, null);
@@ -349,7 +349,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         PBKDF2 kdf = new PBKDF2();
         kdf.initialize();
         
-        byte[] secret = Hex.decodeHex("DEADBEEF");
+        byte[] secret = HexSupport.decode("DEADBEEF");
         
         // Just use this as a stand-in for something which is KeySpecifiedAlgorithm but not KeyLengthSpecifiedAlgorithm
         SecretKey derivedKey = kdf.derive(secret, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, 256);
@@ -390,7 +390,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     }
 
     @DataProvider(name = "testVectors")
-    public Object[][] testVectors() throws DecoderException, EncodingException {
+    public Object[][] testVectors() throws DecodingException, EncodingException {
         return new Object[][] {
             // RFC 6070: https://tools.ietf.org/html/rfc6070
             // These are older and use SHA-1-based PRF.
@@ -400,7 +400,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     1,
-                    Hex.decodeHex(whitespace("0c 60 c8 0f 96 1f 0e 71" +
+                    HexSupport.decode(whitespace("0c 60 c8 0f 96 1f 0e 71" +
                                              "f3 a9 b5 24 af 60 12 06" +
                                              "2f e0 37 a6"))},
             
@@ -410,7 +410,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     2,
-                    Hex.decodeHex(whitespace("ea 6c 01 4d c7 2d 6f 8c" + 
+                    HexSupport.decode(whitespace("ea 6c 01 4d c7 2d 6f 8c" + 
                                              "cd 1e d9 2a ce 1d 41 f0" +
                                              "d8 de 89 57"))},
             
@@ -420,7 +420,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     4096,
-                    Hex.decodeHex(whitespace("4b 00 79 01 b7 65 48 9a" + 
+                    HexSupport.decode(whitespace("4b 00 79 01 b7 65 48 9a" + 
                                              "be ad 49 d9 26 f7 21 d0" + 
                                              "65 a4 29 c1  "))},
             
@@ -431,7 +431,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     16777216,
-                    Hex.decodeHex(whitespace("ee fe 3d 61 cd 4d a4 e4" + 
+                    HexSupport.decode(whitespace("ee fe 3d 61 cd 4d a4 e4" + 
                                              "e9 94 5b 3d 6b a2 15 8c" + 
                                              "26 34 e9 84 "))},
              */
@@ -442,7 +442,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
                     Base64Support.encode("saltSALTsaltSALTsaltSALTsaltSALTsalt".getBytes(Charsets.UTF_8), false),
                     4096,
-                    Hex.decodeHex(whitespace("3d 2e ec 4f e4 1c 84 9b" + 
+                    HexSupport.decode(whitespace("3d 2e ec 4f e4 1c 84 9b" + 
                                              "80 c8 d8 36 62 c0 e4 4a" + 
                                              "8b 29 1a 96 4c f2 f0 70" + 
                                              "38"))},
@@ -454,7 +454,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA1,
                     Base64Support.encode("sa\u0000lt".getBytes(Charsets.UTF_8), false),
                     4096,
-                    Hex.decodeHex(whitespace("56 fa 6a a7 55 48 09 9d" + 
+                    HexSupport.decode(whitespace("56 fa 6a a7 55 48 09 9d" + 
                                              "cc 37 d7 f0 34 25 e0 c3"))},
             
             
@@ -466,7 +466,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     1,
-                    Hex.decodeHex(whitespace("12 0f b6 cf fc f8 b3 2c" + 
+                    HexSupport.decode(whitespace("12 0f b6 cf fc f8 b3 2c" + 
                                              "43 e7 22 52 56 c4 f8 37" + 
                                              "a8 65 48 c9 2c cc 35 48" + 
                                              "08 05 98 7c b7 0b e1 7b"))},
@@ -477,7 +477,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     2,
-                    Hex.decodeHex(whitespace("ae 4d 0c 95 af 6b 46 d3" + 
+                    HexSupport.decode(whitespace("ae 4d 0c 95 af 6b 46 d3" + 
                                              "2d 0a df f9 28 f0 6d d0" + 
                                              "2a 30 3f 8e f3 c2 51 df" + 
                                              "d6 e2 d8 5a 95 47 4c 43"))},
@@ -488,7 +488,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     4096,
-                    Hex.decodeHex(whitespace("c5 e4 78 d5 92 88 c8 41" + 
+                    HexSupport.decode(whitespace("c5 e4 78 d5 92 88 c8 41" + 
                                              "aa 53 0d b6 84 5c 4c 8d" + 
                                              "96 28 93 a0 01 ce 4e 11" + 
                                              "a4 96 38 73 aa 98 13 4a"))},
@@ -500,7 +500,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                     Base64Support.encode("salt".getBytes(Charsets.UTF_8), false),
                     16777216,
-                    Hex.decodeHex(whitespace("cf 81 c6 6f e8 cf c0 4d" + 
+                    HexSupport.decode(whitespace("cf 81 c6 6f e8 cf c0 4d" + 
                                              "1f 31 ec b6 5d ab 40 89" + 
                                              "f7 f1 79 e8 9b 3b 0b cb" + 
                                              "17 ad 10 e3 ac 6e ba 46"))},
@@ -512,7 +512,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                     Base64Support.encode("saltSALTsaltSALTsaltSALTsaltSALTsalt".getBytes(Charsets.UTF_8), false),
                     4096,
-                    Hex.decodeHex(whitespace("34 8c 89 db cb d3 2b 2f" + 
+                    HexSupport.decode(whitespace("34 8c 89 db cb d3 2b 2f" + 
                                              "32 d8 14 b8 11 6e 84 cf" + 
                                              "2b 17 34 7e bc 18 00 18" + 
                                              "1c 4e 2a 1f b8 dd 53 e1" + 
@@ -525,7 +525,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
                     SignatureConstants.ALGO_ID_MAC_HMAC_SHA256,
                     Base64Support.encode("sa\u0000lt".getBytes(Charsets.UTF_8), false),
                     4096,
-                    Hex.decodeHex(whitespace("89 b6 9d 05 16 f8 29 89" + 
+                    HexSupport.decode(whitespace("89 b6 9d 05 16 f8 29 89" + 
                                              "3c 69 62 26 65 0a 86 87"))},
             
         };

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list