XML Security Generic Hybrid Ciphers

4.2.1 Generic-Hybrid

Identifier:

http://www.w3.org/2009/xmlsec-gh#generic-hybrid (REQUIRED)

The Generic-Hybrid encryption algorithm may be used for a variety of purposes; in particular, when used with a key encapsulation mechanism such as those specified in Section 4.3 Key Encapsulation Algorithms and a suitable key wrap algorithm, it can be used for key transport with tight security proofs.

The GenericHybridCipherMethod element shall appear as a child element of xenc:EncryptedData or xenc:EncryptedKey when Generic-Hybrid is specified as the Algorithm value of an xenc:EncryptedData or xenc:EncryptedKey element.

4.3.1 RSAES-KEM

Identifier

http://www.w3.org/2009/xmlsec-gh#rsaes-kem (REQUIRED)

RSAES-KEM is a key encapsulation algorithm based on the RSA encryption scheme.

Given a recipient's public RSA key (n, e) where n is the RSA modulus and e is the public exponent, the following steps shall be taken to encapsulate a symmetric key when the RSAES-KEM key encapsulation algorithm is used (these are the same steps as specified in Section 11.5.3 of [ISO18033-2]):

1. Generate a non-negative random number r less than the modulus n;
2. Set R = I2OSP(r, len(n)) where I2OSP is the integer to octet string conversion specified in Section 4.1 of PKCS #1 [PKCS1] and len(n) is the length of the modulus n;
3. Set c0 = RSAEP((n , e), r) where RSAEP is the RSA encryption primitive defined in Section 5.1.1 of PKCS #1 [PKCS1] (i.e. no padding);
4. Set C0 = I2OSP(c0, len(n));
5. Compute K = KDF(R, KeyLen, OtherInfo) where KDF is the key derivation function, KeyLen is the length of the encapsulated key and OtherInfo is optional other info (subject to the input parameters for the key derivation function, see [XMLENC11] Section 5.4);
6. Output the key K and ciphertext C0.

Given a recipient's private RSA key (n, d) where n is the RSA modulus and d is the private exponent, the following steps shall be taken to decrypt an encapsulated symmetric key from ciphertext C0 when the RSAES-KEM key encapsulation algorithm is used (these are the same steps as specified in Section 11.5.4 of [ISO18033-2]):

1. Set c0 = OS2IP(C0) where OS2IP is the octet string to integer conversion specified in Section 4.2 of PKCS #1 [PKCS1];
2. Set r = RSADP((n , d), c0) where RSADP is the RSA decryption primitive defined in Section 5.1.2 of PKCS #1 [PKCS1] (i.e. no padding);
3. Set R = I2OSP(r, len(n));
4. Compute K = KDF(R, KeyLen, OtherInfo) where KDF is the key derivation function, KeyLen is the length of the encapsulated key and OtherInfo is optional other info (subject to the input parameters for the key derivation function, see [XMLENC11] Section 5.4);
5. Output the secret key K.

For use of the RSAES-KEM key encapsulation algorithm with Key Transport, see Section 5 Using Key Encapsulation Algorithms for Key Transport.

4.3.2 ECIES-KEM

Identifier

http://www.w3.org/2009/xmlsec-gh#ecies-kem (REQUIRED)

ECIES-KEM is a key encapsulation algorithm based on the Elliptic Curve scheme.

Given a recipient's public EC key h and an elliptic curve E with base point g and order (size) o, the following steps shall be taken to encapsulate a symmetric key when the ECIES-KEM key encapsulation algorithm is used (these are the same steps as specified in Section 10.2.3 of [ISO18033-2]):

1. Generate a positive random number r less than o;
2. Compute the elliptic curve point G = r * g where * denotes scalar multiplication;
3. Compute the elliptic curve point H = r * h;
4. Set C0 = ENCODE ( G ) where ENCODE is the encoding of the elliptic curve point G as specified in Section 4.4.2 of [XMLDSIG11].
5. Set P = ENCODE ( H ) where ENCODE is the encoding of the elliptic curve point H; since H is a point on the curve the encoding shall again be as specified in Section 4.4.2 of [XMLDSIG11];
6. Set K = KDF( C0 | P, KeyLen, OtherInfo ) where KDF is the key derivation function, KeyLen is the length of the derived key and OtherInfo is optional other info (subject to the input parameters for the key derivation function, see [XMLENC11] Section 5.4);
7. Output the key K and ciphertext C0.

Given a recipient's private EC key x and an elliptic curve E with base point g and order (size) o, the following steps shall be taken to decrypt an encapsulated symmetric key from ciphertext C0 when the ECIES-KEM key encapsulation algorithm is used (these are the same steps as specified in Section 10.2.4 of [ISO18033-2]):

1. Set G = DECODE ( C0 ) where DECODE is the decoding function which is the reverse of the ENCODE function previously described;
2. Compute the elliptic curve point H = x * G where * denotes scalar multiplication;
3. If H = 0, then fail;
4. Set P = ENCODE ( H ) where ENCODE is the encoding of the elliptic curve point H as specified in Section 4.4.2 of [XMLDSIG11].
5. Set K = KDF( C0 | P, KeyLen, OtherInfo ) where KDF is the key derivation function, KeyLen is the length of the derived key and OtherInfo is optional other info (subject to the input parameters for the key derivation function, see [XMLENC11] Section 5.4);
6. Output the secret key K.

For use of the ECIES-KEM key encapsulation algorithm with Key Transport, see Section 5 Using Key Encapsulation Algorithms for Key Transport.