<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 1/21/15 6:53 AM, Sandy wrote:<br>
</div>
<blockquote
cite="mid:CA+4cBy5=spwTeqseyL-j71EepUqCXqp8_0O3MLzuyYDJbCZfCA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div><br>
<div>ERROR org.opensaml.xml.encryption.Decrypter -
Error decrypting the encrypted data element<br>
org.apache.xml.security.encryption.XMLEncryptionException:
Invalid AES key length: 1218 bytes<br>
<br>
</div>
<div>My Cryptography knowledge is limited, so pardon me
if I'm wrong. WikiPedia says AES is symmetric key
algorithm. If IdP uses public key for encryption, why
does org.opensaml.xml.encryption.Decrypter</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Unrelated to your problem, but for SAML-specific decryption you
should really use: org.opensaml.saml2.encryption.Decrypter<br>
<br>
<blockquote
cite="mid:CA+4cBy5=spwTeqseyL-j71EepUqCXqp8_0O3MLzuyYDJbCZfCA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div> try to decrypt using AES and fails?<br>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
As Scott said, you are (implicitly) trying to decrypt the data
directly rather than the key. See below.<br>
<br>
<br>
<br>
<blockquote
cite="mid:CA+4cBy5=spwTeqseyL-j71EepUqCXqp8_0O3MLzuyYDJbCZfCA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div> StaticKeyInfoCredentialResolver skicr = new
StaticKeyInfoCredentialResolver(trustedCredentials);<br>
Decrypter samlDecrypter = new
Decrypter(skicr,null,null);<br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
I said "implicitly" b/c the error is that you are passing in your
KeyInfoCredentialResolver instance containing the decryption private
key as the wrong argument. It should be the 2nd constructor arg,
not the 1st. The 1st can be null in this case. You do need to also
pass a non-null 3rd arg, an EncryptedKeyResolver instance. Rather
than re-gurgitate details on the latter, I'll refer you to the wiki,
which has some good examples:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption">https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption</a><br>
<br>
<br>
--Brent<br>
<br>
<br>
<br>
<br>
</body>
</html>