Decrypting an Assertion

Sat Oct 20 21:30:50 EDT 2012

Good Evening,

I am trying to decrypt an assertion using opensaml. I am close
following below article:

https://wiki.shibboleth.net/confluence/display/OpenSAML/OSTwoUserManJavaXMLEncryption

In my test program first I try to encrypt an assertion, I use x509cert
from metadata of the entity. I am able to build an encrypted
assertion.

During decryption, I build a  BasicCredential using private key and
public key from the keystore. ( I just build this keystore using
existing key and crt created using openssl and made sure cert is same
that is used in SAML metadata).

However program fails with following message:

org.opensaml.xml.encryption.DecryptionException: Failed to decrypt EncryptedData
	at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:523)
	at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:439)
	at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:400)
	at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:140)
	at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:68)
	at com.mountaintop.saml.AssertionDecryptor.decryptAssertion(AssertionDecryptor.java:55)

My Encrypted message looks like following

Your input will be appreciated.
Thank you.
rn

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
Consent="urn:oasis:names:tc:SAML:2.0:consent:obtained"
Destination="http://blackdog.cis.neustar.com:8080/samlACS/servlet/ACS"
ID="_50daf2a7-50af-480c-9690-7be361b63d3f" InResponseTo="105421439"
IssueInstant="2012-10-21T01:07:32.004Z" Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://c.decellc.com/</saml2:Issuer><ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_50daf2a7-50af-480c-9690-7be361b63d3f">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces
PrefixList="ds saml2 saml2p xenc"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>R7rRy8J+7thDIUYbRgui6uY8AdU=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
jY+8JcMIZVWqv81FrGMsWD92oGDPtwesGgqX7+93TjlGlhhvhBWerqTfSqJ/I7pLDIoZcuGXwMLm
j1X2+TXcjYBvOv8zAnWQQ7FQHI3xvNcK8586pJYgZ+QCAuLSjimrXav8iyMGuBrc7XQwuZRTLUH2
GeQr2AZ6r28Dwvc3u08=
</ds:SignatureValue>
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDwDCCAymgAwIBAgIBAjANBgkqhkiG9w0BAQQFADCBmDELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AlZBMREwDwYDVQQHEwhTdGVybGluZzEOMAwGA1UEChMFQ0VSVEExDTALBgNVBAsTBERFQ0UxIzAh
BgNVBAMTGnN0b214bGJzYjkxLnZhLm5ldXN0YXIuY29tMSUwIwYJKoZIhvcNAQkBFhZzYW50b3Mu
amhhQG5ldXN0YXIuYml6MB4XDTEwMDMyMDEyNTQyNFoXDTExMDMyMDEyNTQyNFowgYoxCzAJBgNV
BAYTAlVTMQswCQYDVQQIEwJWQTERMA8GA1UEBxMIU3RlcmxpbmcxDTALBgNVBAoTBERlY2UxEjAQ
BgNVBAsTCVNBTUwgVGVhbTESMBAGA1UEAxMJbG9jYWxob3N0MSQwIgYJKoZIhvcNAQkBFhVzYW50
b3MuamhhQG5ldXNhci5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK3PZCEwFzcr3P01
oAXjrTgdrd2zrve8obMKOawXOd41pqWrT/LVQ4pL2jjpO4um6w3LVjH1TS+iN3VKTirl3kHoP0kg
w1VH7nEJDcbThwBGl9szaNn08Ar2aKLYdm5W6Bl+0NYg1iUSwLhaBTZ1w6uGtu4S9vYM9F78OrzK
MU+VAgMBAAGjggEkMIIBIDAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVy
YXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUHZNUZfeTCJcTTrz2ROb9a+tVYhswgcUGA1UdIwSB
vTCBuoAUZhJGOUoQsojOI5UWvyqkSgQm3FChgZ6kgZswgZgxCzAJBgNVBAYTAlVTMQswCQYDVQQI
EwJWQTERMA8GA1UEBxMIU3RlcmxpbmcxDjAMBgNVBAoTBUNFUlRBMQ0wCwYDVQQLEwRERUNFMSMw
IQYDVQQDExpzdG9teGxic2I5MS52YS5uZXVzdGFyLmNvbTElMCMGCSqGSIb3DQEJARYWc2FudG9z
LmpoYUBuZXVzdGFyLmJpeoIBADANBgkqhkiG9w0BAQQFAAOBgQAV4lvxElyiQxCH0YOXvCEAO9G8
E2vwvDYlvRN7KEyX/g8F+82szpKAmLHCW8NLYRYoDTn71J8cANQhkc+T8D3jxcYboFvDJv6ClGrb
MugZh8Q6hqYhjkAA1Q+WIJ2J/YX6CLs1GpI68BFKuqaSlKIlbdFkb7fds8CJNGI3G5UOog==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2p:Status><saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:EncryptedAssertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><xenc:EncryptedData
Id="_06bdef55dda3d43af1969bb21b0a05c8"
Type="http://www.w3.org/2001/04/xmlenc#Element"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/><ds:KeyInfo
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:RetrievalMethod
Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"
URI="#_a11dacd415d5b9c444bf2805e2ba8dc3"/></ds:KeyInfo><xenc:CipherData
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>YAEjQFUD0ZkkF7CVkjzLTzjhEHDCkV2fSTAwfOP/I/SlYOT7b2dPus6kpwr56HXTlGVevg/TM4ep
8VxB7YpNH+KmT4e00k3vkBlQtnzXpL0KhDDKc2qiM1PhjA77L5zrAdjkl7zxW1OlzaK6Zd22NYhB
fVBnfzIAKsa8jx1DbKC8icf7Gp2DjhuLoKZbQxRLIXaJ49H2lsoUMhSsfdquvRAP0Ycu6ea3cx8w
Kp0U6+03lyasfPsY2JEaza+xqEz1fqOuhsiSkr4nLt1dloJdkTSS/hdN5FVclKS7haC9EZhuQGqO
jexwIm1B1X+0RLt7MytcnL50Lr+di7tjFcKLDgDBVxaM1uFyuRu2St8nSvgcVz9lZD0XGr6kmepR
n2r3mApeMvt6+fnWW2r0RZ/heyCp4DcB8QkFgJGvwmxrHeeJ9alT98frWarwT598uphq4IP6q6Ex
onJ/Yad6lNV0zsnukK25lvuCVuHseXDdefx5orYQMSaMo07it+AghpqS7n9wBRSbmKho3fquLPUe
PaNFchjCkTCDTqOoGlHyZMfu/HxRnnlmqpG4b6yMHKzHege5HDnc51M8vEYYyX5osajH7QgXVjPm
lpce+WxZCfdOSbQMgbshqEJ/hCF+2cEz98Z6aqZ6jh29ViBRhVHv6skdF+QlDCh/CeuiYfsv5JQ4
oy9RR01e6E0KAiArVJKJG7W79/yoA6IDe0RBeRRvckQOEmDdd9qU6L7/b4urVxsenHulbBusZ7+O
7DQpudCVCciOw+6WSsIhNC1heASKK/7uUTiT4aEbZg6I/mLOXU1GLZOooU/+P8cZuNqjkUvhBL5X
OA/q2x87CMOfVIdTHGcRzv3PPpYmyCg0Z8+4TXWlFgIPjtTz335/7OHJB9oRGQJGoAuc3xTlzzMn
xzteyTJqQGbTjXIadQ5LK5BUxRtipPiUE7HuingvLYzOUmpmJPGLge4qpZnJ63i+0LHXMz2VqTe6
IfVxJgVZ5+fBffpzrh9YFNldkKXYZ9wyE3x8kKN9gbaTgFK6L4vzrbvII6Y0/xwuFL2cFiGxGy+o
PPxO68NXcCvOtUGpLK2eYNjfEEtIgEhTX/Uk3NdMz2qCtvn8guSCmNZS+guo4A/khMoB5PDhXAbD
RGZy+21rCGFY1kpJx7nkT7iFkEZ8bv3eR+gqpUGWn22OqmgQOCk44Zkivs7CIdxDy4IHa7F2CgrP
PJOFIi7mWmkJDOZZfdAyBzI2mLnlSjcmFMvbpaMzy0NGIdl/DcHcmYViIVNmAcbfqDiJm58G2uH5
ZD8kUDdBiLqX2EC13vDfjcd0U2Dzft9G4AFxkex6Wn6i/0vKmP25CfR8oFFuhy84CEMK8yT2cHUU
ZBhCiDhnGKUTFIzzusSguqiN1ZnPHtTHBVzIELH7wyhPijLq45vG9N6q3o+ErXFnZmCcIzt+78TE
P9C7mHD/N/TvX0WQJRAuI43dnfH3QD0/P5//7gBqDsJFYuDUETh2g//jI20AFubArJyxnDAQDoMh
EifCjmAPLLzsvNvHq0jp1VBCNpWu5FoPsoaI9QFJ/86yxaKNs7VZkfLr8XhO0bQ20idqmcYRGysY
bx68yP6hOtxTtjUqS889W4jcI3t/3oeosfn1cmNtWt6DImFZpqkIoDA62HtKX0QHHSUC5mAqSs/t
5ao/19sWQIICxVpW7Peiq2bYN8G0AILKVOaYHW4qqp8pBjuN8eDP7w+YkchgTRz3UExOpRmkdjNV
K0R3E2Re+zAvUMEc3C/cKUPzAU69oN+fyZBUdFlmWBd/jcQl5Y/AKUEALVTYHIXcDfKgZLhZ8U1u
pQLpbzo/Ijr/kPLuf3bnLmdFOknSWAyFIe3LVoDmM7ac7wUF1HK3sphRnQ+sm9IGHRlt2CLc6Pww
XzrzaZDvB1VvVBI6P+IPtVh+Asjle1wTZ4hDcclgp5fYhj8x1cNEILm+KA2wFsBedx6On9Gu+euh
XP/hMzNdkatsNvB+bWDxW0yt8HFIm9KK6oFIDOR0QA98VxoywHFz7abLtCRRrQHcMACCvBAaIHxO
7iGDvIuDn7QKimqsayuo6xWUCZEb7r57WeTyKV8ByMpHuw1FiQwLMKG+JxEKVtA0NSdWlNwiZ3JR
zJbaOiXBBYL51Zo+M7mXRcpwS0MhWT7D+lZhmvghuWd+0QtOCQvwp43g/y0hT3Zu4mdnoUg9hWu/
tvytXWRr+OwMknMHWMOSguqzM+MBorumUG2+f8ox/qi3u8Zz3+JrdnPfcMhCLBLhe5SJYwUW2jUB
jp6mxhleGjOs8oGFTCup88c6DX6Kh1/EY/REtW0CIO+DvQ==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData><xenc:EncryptedKey
Id="_a11dacd415d5b9c444bf2805e2ba8dc3"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/></xenc:EncryptionMethod><ds:KeyInfo
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate>MIICfDCCAeUCAQEwDQYJKoZIhvcNAQEEBQAwga8xCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhWaXJn
aW5pYTERMA8GA1UEBxMIU3RlcmxpbmcxGjAYBgNVBAoTEVVsdHJhRE5TLCBOZXVzdGFyMREwDwYD
VQQLEwhVbHRyYUROUzElMCMGA1UEAxMcc3R1bGhkZXVhMS51bHRyYS5uZXVzdGFyLmNvbTEkMCIG
CSqGSIb3DQEJARYVZGV2QHVsdHJhLm5ldXN0YXIuY29tMB4XDTA5MDEyNzE3MjA1M1oXDTE0MDEy
NjE3MjA1M1owXTEZMBcGA1UEAxMQMDcwNDM3QkIwMEY0MEY5OTELMAkGA1UEBhMCVVMxEDAOBgNV
BAgTB0FyaXpvbmExDjAMBgNVBAcTBVRlbXBlMREwDwYDVQQKEwhVbHRyYUROUzCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEAxsIlsdxAq0VtLlet+csU5ihujDvbiny3BEilT/3xkGsgwWjn7fsl
fZUnPjluJEERUqLwmHFLo2ss0Z2+U8PNXFI2NJ90S99iUU/ZuhiTmRsF24xhXUvHYELsUl+LCpKo
ZAZnL6REgYDeRe5r5HFTv6+U88f01S8bF+fOIuL2MzECAwEAATANBgkqhkiG9w0BAQQFAAOBgQAw
TnifPUz5G5yB/kCmBT3A0NaKzzJCZJUV0AtBGmEi0a6pSqG9CxjY3tnMaxpMbUqyFlPJmmjvzRIv
iTg3ILNhBuupRR5EWxuBWJ9xsQBl5EXDmAWA0nUoBHP4KGmw9E8cHb33rxxK/nd2VjVYnnlUFL9M
BMIgacM0iTaqpz3I8g==</ds:X509Certificate></ds:X509Data></ds:KeyInfo><xenc:CipherData
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>d7Rw8/Z8OFdeXZo6x9uFeik0s6oepIpXQ5a0juLy8EMlttsLgy3LpEpajWMB2JbiFqTh0p2dNyAr
n5WqNSxwPpruHdjmMFLlUINPP+T1f1xsVkzaGfxmbViCBkJa5tSMCnx6Vkhh2ez7yRf5ssApoORU
+uFqXrrMyYyI+3eNAPw=</xenc:CipherValue></xenc:CipherData><xenc:ReferenceList><xenc:DataReference
URI="#_06bdef55dda3d43af1969bb21b0a05c8"/></xenc:ReferenceList></xenc:EncryptedKey></saml2:EncryptedAssertion></saml2p:Response>