Decrypting assertion fails

[Brent Putman]

On 1/21/15 6:53 AM, Sandy wrote:
>
> ERROR org.opensaml.xml.encryption.Decrypter  - Error decrypting the
> encrypted data element
> org.apache.xml.security.encryption.XMLEncryptionException: Invalid AES
> key length: 1218 bytes
>
> My Cryptography knowledge is limited, so pardon me if I'm wrong.
> WikiPedia says AES is symmetric key algorithm. If IdP uses public key
> for encryption, why does org.opensaml.xml.encryption.Decrypter

Unrelated to your problem, but for SAML-specific decryption you should
really use:  org.opensaml.saml2.encryption.Decrypter

> try to decrypt using AES and fails?


As Scott said, you are (implicitly) trying to decrypt the data directly
rather than the key.  See below.



>     StaticKeyInfoCredentialResolver skicr = new
> StaticKeyInfoCredentialResolver(trustedCredentials);
>     Decrypter samlDecrypter = new Decrypter(skicr,null,null);


I said "implicitly" b/c the error is that you are passing in your
KeyInfoCredentialResolver instance containing the decryption private key
as the wrong argument.  It should be the 2nd constructor arg, not the
1st.  The 1st can be null in this case.  You do need to also pass a
non-null 3rd arg, an EncryptedKeyResolver instance.  Rather than
re-gurgitate details on the latter, I'll refer you to the wiki, which
has some good examples:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption


--Brent




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150121/2a860638/attachment.html