<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"> <!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/90a13678e9a8ffc7682d7c4206e10a5a?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FSS-1.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="5e1f387fa531f30ca3849078" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_5e1f387fa531f30ca3849078" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5e1f387fa531f30ca3849078"> Stefan Santesson </a> <strong>created</strong> an issue </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr> <!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"> <a href="https://shibboleth.atlassian.net/browse/OSJ?atlOrigin=eyJpIjoiYjhkNDBhNWM2ZjhlNDUwZTg5ZDdlMjMxMzI1M2UwOGMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">OpenSAML - Java</a> / <a href="https://shibboleth.atlassian.net/browse/OSJ-355?atlOrigin=eyJpIjoiYjhkNDBhNWM2ZjhlNDUwZTg5ZDdlMjMxMzI1M2UwOGMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-49d90fc6-f4fb-4b61-aab8-61e3349ea08c" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://shibboleth.atlassian.net/browse/OSJ-355?atlOrigin=eyJpIjoiYjhkNDBhNWM2ZjhlNDUwZTg5ZDdlMjMxMzI1M2UwOGMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">OSJ-355</a> </td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/OSJ-355?atlOrigin=eyJpIjoiYjhkNDBhNWM2ZjhlNDUwZTg5ZDdlMjMxMzI1M2UwOGMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">ConcatKDF parameter requirements too restrictive in ECDH</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-avatar-49d90fc6-f4fb-4b61-aab8-61e3349ea08c" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Affects Versions:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 4.1.1 </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="557058:97de0981-adc3-4044-95ed-131622fad81e" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_557058:97de0981-adc3-4044-95ed-131622fad81e" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e"> Brent Putman </a> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Components:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> Security </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 27/Jun/22 8:51 AM </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-static-trivial-1734e3c6-9101-40e3-95e0-cf2ec798cc99" height="16" width="16" border="0" align="absmiddle" alt="Trivial" style="vertical-align: text-bottom"> Trivial </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="5e1f387fa531f30ca3849078" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_5e1f387fa531f30ca3849078" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5e1f387fa531f30ca3849078"> Stefan Santesson </a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0; margin-top: 0">I wave come across an interop problem with OpenSAML 4 implementation of ECDH which I believe is a bug in Open SAML 4.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0"><ins><b>Background:</b></ins></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">I was the main developer of the inner logic of Sweden Connect Open SAML extension library where we added ECDH support to Open SAML 3.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The repo for this work is here: <a href="https://github.com/swedenconnect/opensaml-security-ext" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://github.com/swedenconnect/opensaml-security-ext</a> </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">We submitted this work to OpenSAML and got a nice response from Scott that you would look at this when implementing this in OpenSAML 4, which we assume you did.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">Since OpenSAML 4 came out, we have removed ECDH from our library. The old version (version 1.07) of our lib that includes ECDH is available here: <a href="https://github.com/swedenconnect/opensaml-security-ext/tree/release/1.0.7-release" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://github.com/swedenconnect/opensaml-security-ext/tree/release/1.0.7-release</a> </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The issue:</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">In an interop test last week I discovered that an encrypted assertion created by our lib 1.0.7 with OpenSAML 3 could not be decrypted by a recipient using Open SAML 4. The recipient application is the EU commission CEF implementation of eIDAS nodes version 2.6 (<a href="https://ec.europa.eu/digital-building-blocks/wikis/display/DIGITAL/eIDAS-Node+Integration+Package" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://ec.europa.eu/digital-building-blocks/wikis/display/DIGITAL/eIDAS-Node+Integration+Package</a> )</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The reason for the problem is that we send the following ConcatKDF parameters by default:</p>
<div class="preformatted panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0">
<div class="preformattedContent panelContent" style="padding: 9px 12px">
<pre style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal; white-space: pre; word-break: normal; word-wrap: break-word; word-break: break-all; white-space: pre-wrap"><xenc11:ConcatKDFParams AlgorithmID="00" PartyUInfo="00" PartyVInfo="00" >
<ds:DigestMethodAlgorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
</xenc11:ConcatKDFParams></pre>
</div>
</div> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">This results in an error in OpenSAML 4 that complains that AlgorithmID has an illegal value. The problem is claimed to be that the ApplicationID parameter has no value.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">This is true since the "00" is just a counter of padding bits. The value "00" therefore means no value with no padding bits. </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">We think we understand were this interpretation of the standard comes from. XML enc standard on this matter (<a href="https://www.w3.org/TR/xmlenc-core1/#sec-ConcatKDF" title="smart-link" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://www.w3.org/TR/xmlenc-core1/#sec-ConcatKDF</a> ) states: "<b><em>Their presence is optional but AlgorithmID, PartyVInfo and PartyUInfo must be present for applications that need to comply with [SP800-56A]</em></b>".</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">Note here that <b>SP800-56A</b> defines the inner format of the data that follows after the initial padding byte ("00"). The use of the padding byte ("00") is simply a convention defined by XML enc. These padding bytes are not described in <b>SP800-56A</b> and they are stripped from the actual values being concatenated.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The problem here is that <b>SP800-56</b> requires AlgorithmID, PartyVInfo and PartyUInfo values to be non null, but that XML enc overrules that by making SP800-56A parameters optional. The exact wording is: "must be present for applications that need to comply with [SP800-56A]". This means that we don't have to send a value unless our application intends to make use of those values in any meaningful way according to SP800-56A. And we don't, as we completely discard any content communicated here.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">At the time we had a quite extensive discussion about this, which if I recall this right, involved people at NIST. supporting that <b><em>AlgorithmID="00" PartyUInfo="00" PartyVInfo="00"</em></b> should be a valid input to XML enc.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0"><ins><b>Resolution:</b></ins></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">As an immediate fix, we have just made a new release 1.0.8 that sends the following ConcatKDF (that is accepted by OpenSAML 4): <b><em>AlgorithmID="0000" PartyUInfo="0000" PartyVInfo="0000"</em></b></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">But this will not completely solve the problem as there are some current implementations using 1.0.7 that will fail as long as OpenSAML 4 is restrictive.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">We suggest that OpenSAML 4 is fixed to accept also empty values <b><em>AlgorithmID="00" PartyUInfo="00"PartyVInfo="00"</em></b> for several reasons:</p>
<ul>
<li>These values are not used for anything</li>
<li>As they are fixed values, they don't add anything to the security of the protocol</li>
<li>Making this restriction solves no problem, adds no security, but causes interop issues.</li>
</ul> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"> <script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/OSJ-355?inbox=true&",
"name": "View Issue"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/OSJ-355#add-comment?atlOrigin=eyJpIjoiYjhkNDBhNWM2ZjhlNDUwZTg5ZDdlMjMxMzI1M2UwOGMiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-b2312d49-8059-47c9-b265-d1e6257741be" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://shibboleth.atlassian.net/browse/OSJ-355#add-comment?atlOrigin=eyJpIjoiYjhkNDBhNWM2ZjhlNDUwZTg5ZDdlMjMxMzI1M2UwOGMiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr> </td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100201-<span title="10a069bc9d27e2e7b1c8aa8c86926c9bf4454379" data-commit-id="10a069bc9d27e2e7b1c8aa8c86926c9bf4454379}">sha1:10a069b</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-a4b24e32-d475-4dc2-9973-10b52b55c3f8" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>