RSA-OAEP interop issues

[Cantor, Scott]

On 9/24/14, 8:36 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>In v2, on encryption we always add an explicit ds:DigestMethod with SHA-1
>if it wasn't already added by Santuario.  IIRC, at the time we found that
>some other libraries (I think including Santuario C++) didn't like it if
>you left that out.  For v3, it seems reasonable to leave that in.  It's
>technically never wrong to explicitly express it, even if it's the
>implicit default. Do you disagree?

No, especially if we're already doing that, I wouldn't want to try and
figure out what breaks if we remove it. I vaguely recall there being a
bug, yes.

>Now with the new Encryption 1.1 variant, I was looking at what to do with
>xenc11:MGF re: always expressing it explicitly (or not) if it's the SHA-1
>default.  Do you have any opinions?

IIRC, that only applies when the algorithm is explicitly the 1.1 OAEP
variant? In which case it won't really break any old code, so I would say
just express it, that's just clearer/simpler.

>In particular, I was wondering what the current state of Santuario C++
>and the SP is wrt the 1.1 variant.  I'm assuming it fundamentally
>supports this key transport at some level. Does it support MGF's other
>than the default MGF-1 w/ SHA-1?

The comment in the code is outdated, but eyeballing it appears to support
all the SHA-2 variants as both DigestMethod and MGF digest, as long as
OpenSSL has the SHA-2 support. I doubt I tested it much other than against
any test vectors I scrounged up.

>If not, will it
> barf if it encounters an explicit xenc11:MGF element?  If so, does it
>conversely require that the xenc11:MGF be explicitly expressed?

No, it defaults it.

>And since Java Santuario and OpenSAML now support explicitly-configured
>OAEPparams, would also be nice to now what C++ Santaurio and OpenSAML
>support there, or not.

Encryption hasn't gotten much attention because there was nothing to
encrypt to. The OpenSAML APIs don't have any support right now for
expressing algorithm suboptions. The Santuario stuff is messy but I think
if you pass in the EncryptedKey object somehow, it can pull the suboptions
to use from that structure and it looks like it should honor them. I don't
know if it all hands together, I was focused on consuming it.

>Is anyone aware of any other interop issues we need to consider here,
>such as what SimpleSAMLphp's SP supports?  I'll try looking on their
>site, but thought I would ask here also.

I would be pleasantly surprised if GCM or OAEP 1.1 were supported, but I
don't know.

-- Scott