XMLSecurity exception while decrypting: Errors occurred during de-serialisation

[Scott Cantor]

> I'll double check where that exception is raised, but I do believe it's during the step where the Santuario code deserializes the encrypted content back into XML because it's typed as an XML Element being encrypted (that's what EncryptedAssertion represents).

That is where the exception is raised. The decrypted data is being handled as UTF-16 and then turned into UTF-8 for parsing by Xerces using a parser instance Santuario creates internally.

It's one of the places we have the least control over anything that goes on and none of it was originally any code I wrote.

I don't honestly know how it ever works, but I would bet it's buggy as hell when it comes to handling some kinds of content, and it would be very sensitive to Unicode issues.

I would probably start by turning off encryption and just see what gets passed over in plaintext, and if that doesn't help I would be looking at reproducing it with a dummy key that could be packaged up with a sample so it could be run through other decryption implementations.

-- Scott