XML-Encryption Requirements

1. Introduction

The XML 1.0 Recommendation [XML] describes the syntax of a class of data objects called XML documents. There is interest in a specification of XML syntax and processing for encrypting digital content, including portions of  XML documents and protocol messages. This documents provides requirements for such an activity -- as well as provocation and alternative requirements.

2. Design Principles and Scope

This section describes requirements over intended result, how these motivations are realized are addressed in subsequent sections.

1. The XML Encryption specification will describe how to use XML to represent a digitally encrypted Web resource (including XML itself).  {Imamura, SL}
   1. The specification must provide for the encryption a part or totality of an XML document
      1. Granularity of encryption is limited to an element (including start/end tags) or element content (between the start/end tags). {Imamura, WS}
      2. Granularity of encryption also includes attribute values. {SL, WS}[Workshop participants were split on this issue]
      3. Granularity is limited to the note-set specified by a user specified XPath expression {List: Huck}[Note there concerns that XPath not be required for XML Encryption.]
      4. Granularity of encryption includes any Information Set Item. {List: Reagle}[No one strongly advocated this position]
   2. The specification must provide for recursive encryption (capable of encrypting XML with portions already encrypted). {Imamura, SL}

   3. The specification must provide for the separation of encryption information from encrypted data, and support reference mechanisms for addressing encryption information from encrypted data sections. {HP: R3.7}

2. The XML Encryption specification should strive to limit optionality and maximize extensibility such that all of the specification can be quickly implemented
3. The XML Encryption specification must addresses security concerns arising from the design and its implementation.
4. The mechanisms of encryption must be simple: describe how to encrypt/decrypt digital content, XML documents, and portions thereof. {Reagle}
   1. Only enough information necessary for decryption need be provided. {Reagle}
   2. The specification will not address the confidence or trust applications place in the provision of a key
   3. The specification will not address authentication. {List: Reagle, WS}
   4. The specification will not address authorization and access control. {List: Reagle, Simon, Kudoh, WS}
5. If the working group addresses an Information Set representation or canonicalization, it must use pre-existing data models (e.g., Information Set) and canonicalization methods (e.g., Canonical XML) unless it can explicitly justify the need for a new one. {Reagle}
6. The specification will define a minimal set of algorithms and key structures necessary for interoperability purposes. {Reagle}
7. Whenever possible, any resource or algorithm is a first class object, and identified by a URI. {Imamura, SL}

3. Requirements

Encryption Data Model and Syntax

1. The XML Encryption data model will be predicated on:
   1. a simple enumerated subset of InfoSet {e.g., element, element-content, attribute-value, etc.)  {WS}
   2. XPath {List: Huck}
   3. the RDFS schema within the Information Set specification [Infoset] {Reagle}
   4. [XSet] {Reagle}
2. XML Encryption can be applied to any Web resource -- including non-XML content.    {Imamura, SL}
   1. XML Encryption should be able to work with streaming media. {List: Simon}
3. Encrypted objects are first class objects themselves and consequently can be referenced, encrypted, and signed. {Reagle}

Processing

1. Implementation/Design Philosophy
   1. Parser  {WS}
      1. XML Encryption applications must be XML-namespaces [XML-namespaces] and XML Schema [XML-schema] aware. {Reagle}
      2. Implementation of the specification should have a minimal affect upon XML parser and schema implementations. While {WS:Simon} demonstrated that XML-encryption functionality did not necessarily require any changes to particular DOM and XML parser implementations, it may be necessary for implementors to tweak their parsers as needed.
   2. XML Instances {WS}
      1. Encrypted instances must be well-formed but need not be valid (i.e. applications that encrypt the element structure are purposefully doing so.)
      2. Instance authors that want to validate encrypted instances must do one of the follow:
         1. Write the original schema so as to validate resulting instances and the change in structure and inclusion of element types from the XML Encryption namespace.
         2. Provide a post-encryption schema for validating encrypted instances.
         3. Only encrypt PCDATA text of element content and place DecryptionInfo and KeyInfo in an external document.
2. The processing model should be based on:
   1. Application specific logic {List: Ferguson}
   2. XSLT  {List: Ferguson}
   3. XPath {MyProof}
   4. XLink {List: Maruyama}
3. The encryption and XML processing should be
   1. Fast {List: Ferguson}
   2. Memory efficient {List: Ferguson}
   3. Work with tree and event based parsers {List: Ferguson}
4. Transforms  {WS}
   1. Encryption Transforms
      1. The specification must enable the specification of additional transforms as part of encryption processing using a method similar to that of XML Signature (However in encryption they are applied in reverse order {List: Huck}). This would enable user specified transforms such as compression, canonicalization, advanced padding and signature processing. {HP: R3.4.1, List: Huck}
         1. No XML Encryption transforms are defined or reference.
         2. A compression transform should be defined or references.
         3. A new canonicalization transform should be defined or referenced.
      2. The specification must not enable the specification of additional transforms; transforms must be done by the application and represented in their own syntax (e.g., compression is done by compressing content and rapping that data in an XML compression syntax.)
   2. Signature Transform
      1. The specification must address how to use XML Signature with XML Encryption such that multiple parties may selectively encrypt and sign portions of documents that may already be signed and encrypted.
         1. For the purposes of signature validation, only decrypt those portions specified by the Signature Transforms. (This makes subsequent encryption difficult; plus leaving the signature in the clear if the signed data is encrypted allows plaintext guessing attacks.) {List: Reagle}
         2. When data is encrypted, so is it's Signature; consequently those Signature you can see can be validate. (However, this doesn't work with some cases of detached Signatures.){List: Finney}
         3. If there is no explicit <xenc:NoDecrypt> element within <dsig:SignatureProperty>, the default assumption is to decrypt all the encrypted portions before verification. (odd change to Signature Transform semantics; plus leaving the signature in the clear if the signed data is encrypted allows plaintext guessing attacks.)  {List: Maruyama}
5. Objects
   1. The specification may provide for encrypted representations of non XML data (e.g., MIME-objects).
      1. The specification must define an analog of xmldsig:Object that provides an encoding and type description for the encoded object. {Reagle:xmldsig}
      2. The specification must not define any representation formats. {HP: R2.2, List: Huck}
   2. Binary data may be represented as
      1. Base64 encoding only. {Reagle:xmldsig}
      2. XML Schema 'base64' and 'hex' only.  {HP: R3.5.2, List: Huck}
6. The ways to reference data once encrypted, or supporting information should be referenced via:
   1. URI+IDs
   2. XPath expressions
   3. XLink (provides bi-directional) {WS: not desired in poll}

Algorithms and Structures

1. The solution must work with arbitrary encryption algorithms, including symmetric and asymmetric keys schemes as well as dynamic negotiation of keying material. {Imamura, SL}
2. The specification must specify or reference one mandatory to implement algorithm for only the most common application scenarios. (All options result from Schaad's Algorithm Selections recommendations unless noted.)
   1. Stream Encryption Algorithms
      1. none
      2. RC4 is optional.
   2. Block Encryption Algorithms
      1. AES with CMS keylength is required to implement
      2. AES at other keylengths is optional to implement.
      3. TripleDES is optional to implement.
      4. IDEA as optional to implement {List: Priewe}
   3. Chaining Modes
      1. CBC (Cipher Block Chaining) with PKCS#5 padding is optional to implement.
      2. CTS (Cipher Text Stealing).
   4. Key Transport
      1. RSA-OEAP used with AES is required to implement.
      2. RSA-v1.5 used with TripleDES is optional to implement.
      3. ECIES {List: Blake-Wilson}
   5. Key Agreement
      1. none
      2. Diffie-Hellman is optional to implement
      3. ECDH {List: Blake-Wilson}
   6. Symmetric Key Wrap
      1. CMS-KeyWrap is required for wrapping Triple-DES and RC2 keys
      2. AES KeyWrap from the NSA is mandatory -- when its completely specified.
   7. Message Authentication
      1. XML Signature is optional to implement
   8. Canonicalization
      1. none
      2. Canonical XML is required to implement.
   9. Compression
      1. none
      2. A method for XML redunancy removal should be optional (and should be free of encumbering IP claims) {List: Huck}
   10. Password Derivation Algorith
       1. none
3. @@ Key Structures
   1. The only defined key structures will be those required by the mandatory algorithms. {Reagle}
   2. In addition to key structures required by the mandatory algorithms the following are specified:
      1. X is mandatory.
      2. Y is optional.

Security

1. The specification must address security issues arising where:
   1. An attacker may know the original structure of the plain-text via its schema. {List: Wiley}
   2. An attacker may know the length and redundancy of the plain-text data. {List: Finney}
   3. An attacker may have access to an oracle which encrypts attacker chosen plain-text repeatedly. {Reagle}

Misc

1. @@Where did we stand on the issue of email headers encryptor/recipient?

Coordination

The XML Encryption specification should meet the requirements of (so as to support) or work with the following applications:

1. XML Authorization {List: Scherling, Damiani}
2. [XML Protocols] {Reagle}
3. [XML Signature] {Reagle}

To ensure the above requirements are adequately addressed, the XML Encryption specification must be reviewed by a designated member of the following communities:

1. XML Schema Working Group {Reagle}
2. XML Core Working Group {Reagle}
3. XML Protocol Working Group {Reagle}
4. Internationalization Interest Group {Reagle}

Intellectual Property

1. The specification should be free of encumbering technologies: requiring no licensing fees for implementation and use. {List: Ferguson}

4. References

Imamura

Another proposal of XML Encryption, Takeshi Imamura (Mon, Aug 14 2000)

C2000

Crypto 2000 XML Encryption BoF [ minutes]. Santa Barbara. August 24 .

DOM

Document Object Model Core, Level 3. Arnaud Le Hors. W3C Working Draft.
http://www.w3.org/TR/DOM-Level-3-Core/core.html

HP

Requirements and Goals for the Design of an 'XML Encryption Standard'. Gerald Huck and Arne Priewe. November 2000.

List

XML Encryption List (an unmoderated and unchartered public list).

MyProof

MyProof Position Paper On XML Encryption

InfoSet

XML Information Set, W3C Working Draft. John Cowan.
http://www.w3.org/TR/xml-infoset.

SL

XML Encryption strawman proposal Ed Simon and Brian LaMacchia (Wed, Aug 09 2000)

WS

W3C XML Encryption Workshop [minutes]. SanFrancisco. November 2, 2000.

XML

Extensible Markup Language (XML) 1.0 Recommendation. T. Bray, J. Paoli, C. M. Sperberg-McQueen. February 1998.

http://www.w3.org/TR/1998/REC-xml-19980210

XML-C14N

Canonical XML. Working Draft. J. Boyer. September 2000.

http://www.w3.org/TR/2000/WD-xml-c14n-20000907

XML-ns

Namespaces in XML Recommendation. T. Bray, D. Hollander, A. Layman. January 1999.

http://www.w3.org/TR/1999/REC-xml-names-19990114

XML-schema

XML Schema Part 1: Structures Working Draft. D. Beech, M. Maloney, N. Mendelshohn. April 2000.

http://www.w3.org/TR/2000/WD-xmlschema-1-20000407/
XML Schema Part 2: Datatypes Working Draft. P. Biron, A. Malhotra. April 2000.

http://www.w3.org/TR/2000/WD-xmlschema-2-20000407/

XMLDSIG

XML-Signature Syntax and Processing. Working Draft. D. Eastlake, J. Reagle, and D. Solo.
http://www.w3.org/TR/2000/WD-xmldsig-core-20000918/

XSet

Full Fidelity Information Set Representation. Jonathan Borden. XML-Dev

http://lists.xml.org/archives/xml-dev/200008/msg00239.html

URI

RFC2396. Uniform Resource Identifiers (URI): Generic Syntax. T. Berners-Lee, R. Fielding, L. Masinter. August 1998
http://www.ietf.org/rfc/rfc2396.txt