Functional Explanation of Changes in XML Encryption 1.1

Status of This Document

This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publications and the latest revision of this technical report can be found in the W3C technical reports index at http://www.w3.org/TR/.

In the case of any difference between this document and the XML Encryption 1.1 specification [XMLENC-CORE1], the XML Encryption 1.1 specification is authoritative.

This document was published by the XML Security Working Group as a First Public Working Group Note. If you wish to make comments regarding this document, please send them to public-xmlsec@w3.org (subscribe, archives). All feedback is welcome.

Publication as a Working Group Note does not imply endorsement by the W3C Membership. This is a draft document and may be updated, replaced or obsoleted by other documents at any time. It is inappropriate to cite this document as other than work in progress.

This document was produced by a group operating under the 5 February 2004 W3C Patent Policy. W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy.

2. Changes

2.1 Added Key Derivation

Added support for derived keys, in particular:

Added definitions of Key Derivation algorithms
- Added ConcatKDF algorithm.
- Added PBKDF2 algorithm.
Added XML DerivedKey element
Updated RetrievalMethod description to include DerivedKey.
Updated ReferenceList description to include DerivedKey.

2.2 Added Elliptic Curve Diffie-Hellman Key Agreement

Added Elliptic Curve Diffie-Hellman Key Agreement

2.3 Added Algorithms

Added AES-128-pad, AES-192-pad, and AES-256-pad Symmetric Key Wrap algorithms as optional.
Added SHA-384 Message Digest as optional
Added Canonical XML 1.1 (omit comments) as optional
Added Canonical XML 1.1 with comments as optional
Added key derivation algorithms, ConcatKDF as required, PBKDF2 as optional.
Added Key Agreements, Diffie-Hellman Key Agreement (Ephemeral-Static mode) with Legacy Key Derivation Function and explicit Key Derivation Functions as Optional, and Elliptic Curve Diffie-Hellman (Ephemeral-Static mode) as required

For all algorithms added, algorithm identifiers and information were added to the specification.

2.4 Changed Algorithms

Changed SHA-1 Message Digest to required, but DISCOURAGED.
Changed SHA-256 Message Digest to required
Changed AES-128-GCM Block Encryption as required, added warning about use of CBC block encryption algorithms and reference to paper on attack.
Enabled RSA-OAEP Key Transport to be used with arbitrary mask generation functions (e.g. SHA2 based) by defining an additional RSA-OAEP URI and significantly revising specification text. Added definition of new xenc11:MGF element.
Removed Message Authentication section (not normative)

2.5 Clarifications

Clarified AES-GCM Block Encryption description of the algorithm as equivalent to encryption followed by signing.
Revised processing rules section for clarity on aspects of processing model that are normative and those that are not.
Clarified the Encoding attribute in the EncryptedType element.
Clarified that the syntax of URI and Transforms in the CipherReference element is defined in XML Signature.
Clarified that base64 encoded text is contained as element content when CipherValue element is used.

2.6 Security Considerations Changes

Added security consideration information on Chosen Ciphertext Attacks, including attacks against encrypted data and encrypted key. Provide specific notes on CBC Block Encryption vulnerability, and the Bleichenbacher attack.
Added new security consideration for implementations to limit information included in error responses for security algorithms.
Added new security consideration warning implementers to consider timing attacks.

2.7 Other Changes

Provided new 1.1 namespace for new 1.1 schema items
Replaced normative SP800-56A reference (NIST Special Publication 800-56A: Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography (Revised). March 2007) for ECDH in Section 5.6.4 (Elliptic Curve Diffie-Hellman (ECDH) Key Agreement) with [ECC-ALGS] reference.

Functional Explanation of Changes in XML Encryption 1.1

W3C Working Group Note 18 October 2012

Abstract

Status of This Document

Table of Contents

1. Introduction