<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 9/2/19 2:46 AM, DD K wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAD3X5rb4ahsEOYDPrg9uRh_mv3bX9mkBJeewO+cUJdAOOKWnog@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr"><br>
<div>
<pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"DejaVu Sans Mono";font-size:9pt"><span style="color:rgb(204,120,50)">public static </span>Assertion <span style="color:rgb(255,198,109)">getDecryptedAssertion</span>(EncryptedAssertion encryptedAssertion<span style="color:rgb(204,120,50)">, </span>X509Credential x509Credential)
<span style="color:rgb(204,120,50)">throws </span>DecryptionException<span style="color:rgb(204,120,50)">, </span>KeyStoreException<span style="color:rgb(204,120,50)">, </span>UnrecoverableKeyException<span style="color:rgb(204,120,50)">, </span>NoSuchAlgorithmException {
KeyInfoCredentialResolver keyResolver = <span style="color:rgb(204,120,50)">new </span>StaticKeyInfoCredentialResolver(x509Credential)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> </span>Decrypter decrypter = <span style="color:rgb(204,120,50)">new </span>Decrypter(<span style="color:rgb(204,120,50)">null, </span>keyResolver<span style="color:rgb(204,120,50)">, null</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)">
</span><span style="color:rgb(204,120,50)"> </span>EncryptedKey key = encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().get(<span style="color:rgb(104,151,187)">0</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> </span>SecretKey dkey = (SecretKey) decrypter.decryptKey(key<span style="color:rgb(204,120,50)">, </span>encryptedAssertion.getEncryptedData().
getEncryptionMethod().getAlgorithm())<span style="color:rgb(204,120,50)">; // Error caused here
</span><span style="color:rgb(204,120,50)"> </span>Credential shared = CredentialSupport.<span style="font-style:italic">getSimpleCredential</span>(dkey)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)">
</span><span style="color:rgb(204,120,50)"> </span>decrypter = <span style="color:rgb(204,120,50)">new </span>Decrypter(<span style="color:rgb(204,120,50)">new </span>StaticKeyInfoCredentialResolver(shared)<span style="color:rgb(204,120,50)">, null, null</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> </span>decrypter.setRootInNewDocument(<span style="color:rgb(204,120,50)">true</span>)<span style="color:rgb(204,120,50)">;
</span><span style="color:rgb(204,120,50)"> return </span>decrypter.decrypt(encryptedAssertion)<span style="color:rgb(204,120,50)">;
</span>}</pre>
</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>I think your main issue is that you are using 2 different
Decrypter instances, and you aren't invoking setRootInNewDocument
on the first one, which (I think) is required by how you are using
the output of it. Try that and see how it goes.</p>
<p>A secondary issue is that you don't really need to do all that.
The code above is needlessly complicated. You really just want 1
Decrypter, with appropriate ctor args of:<br>
- arg 0 as null<br>
- arg 1 as the static KeyInfo cred resolver containing the
X509 cred with private key (assuming you don't want a more
realistic resolution strategy)<br>
- arg 2 as an EncryptedKeyResolver covering how you are
placing the EncryptedKey relative to the EncryptedData.</p>
<p>Then it handles internally all of what you are doing - locating
and decrypting the EncryptedKey to SecretKey, then using that to
decrypt the EncryptedData.</p>
<p>It's also artificial to encrypt and then immediately decrypt in
that fashion. To fully test a round trip you really ought to at
least marshall the EncryptedAssertion to DOM and then unmarshall a
new EncryptedAssertion around it. Or even marshall and then
serialize it to something (e.g. byte[]) and then parse it again
and unmarshall.</p>
</body>
</html>