为什么我无法解密此 xmlsec 加密的 WSSE 增强型 SOAP 消息？

我使用了PIP的Py-WSSE，但似乎破裂了。我已经重构/将其修复到

添加X509标准：带签名的签名块，以及通过证书的公共/私钥使用
我能够使用普通的旧XMLSEC对此进行加密/解密，添加了我无法的WSSE组件。
基础进口是XMLSEC（1.35）和OpenSSL。加密/解密由XMLSEC执行，密钥/证书生成由OpenSSL完成。使用这些证书/钥匙文件签名由XMLSec完成。
我在XMLSEC签名的文档上进行预/后处理以创建WSSE文档。同样，当我解密时，我会处理文档以将密钥信息移回EncryptedData块

这是我的签名和加密文档，据我所知，EncryptedData块看起来与我的Vanilla XMLSec文档Asides相同，从一些其他标签中。这不能解密。

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns1="http://hcv.health.ontario.ca/"
                   xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Header>
        <wsse:Security mustUnderstand="true">
            <wsse:BinarySecurityToken
                    EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
                    ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
                    wsu:Id="id-12e0aebc-9024-476f-a43a-5666e9ea2838">
                __cipher__text__here__
            </wsse:BinarySecurityToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod
                            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod
                            Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>qW0RXziKgv89NQN1Jh3r6GiE68k=</DigestValue>
                    </Reference>
                    <Reference URI="#id-392912e7-0b10-4243-86ea-836e13e445f0">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>2RT70EVr3SxEQIsYFRTlCv+E/VQ=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>
                    __cipher__text__here__
                </SignatureValue>
                <KeyInfo>
                    <wsse:SecurityTokenReference>
                        <X509Data>
                            <X509IssuerSerial>
                                <X509IssuerName>
                                    CN=example.com
                                </X509IssuerName>
                                <X509SerialNumber>1000</X509SerialNumber>
                            </X509IssuerSerial>
                            <X509Certificate>
                            __cipher__text__here__
                            </X509Certificate>
                        </X509Data>
                    </wsse:SecurityTokenReference>
                </KeyInfo>
            </Signature>
            <wsu:Timestamp wsu:Id="id-392912e7-0b10-4243-86ea-836e13e445f0">
                <wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
                <wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
    </SOAP-ENV:Header>
    <ns0:Body wsu:Id="id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element"
                            wsu:Id="id-2ba0c3b4-7784-415d-aeca-08a45d504660">
            <xenc:EncryptionMethod
                    Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <xenc:EncryptedKey>
                    <xenc:EncryptionMethod
                            Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                    <xenc:CipherData>
                        <xenc:CipherValue>
                            __cipher__text__here__
                        </xenc:CipherValue>
                    </xenc:CipherData>
                    <xenc:ReferenceList>
                        <xenc:DataReference
                                URI="#id-2ba0c3b4-7784-415d-aeca-08a45d504660"/>
                    </xenc:ReferenceList>
                </xenc:EncryptedKey>
            </ds:KeyInfo>
            <xenc:CipherData>
                <xenc:CipherValue>
                    __cipher__text__here__
                </xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>
    </ns0:Body>
</SOAP-ENV:Envelope>

这是签名和加密文档的" vanilla xmlsec"，可以解密：

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns1="http://example.com/"
                   xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Header>
        <wsse:Security mustUnderstand="true">
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod
                            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod
                            Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#id-61b880d6-e56b-4cfc-bec6-471121c72547">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>NvKgiRH+6Q/xMSJxx/7qtkc+IFY=</DigestValue>
                    </Reference>
                    <Reference URI="#id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>5IoUfViIk5hJTt3Whl7I/jFq+Ww=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>
                    RmbXCTcji8c0ZWuRrCYdBL57FtGiwmX5HlZIol1k/d7d8PIdj0YR/41qP7DlSTD2
                    fspVNXLYc9kEh+YbTbodRsGvHQ/ZUWhXC6dX3/1BjdxrycPcQI37REIO+btla5wR
                    Icn5FvXMHPPJfln9y3ulj/RAjHU44nDKE4m0zWJ8lUo=
                </SignatureValue>
                <KeyInfo>
                    <X509Data>
                        <X509IssuerSerial>
                            <X509IssuerName>
                                CN=example.com
                            </X509IssuerName>
                            <X509SerialNumber>1000</X509SerialNumber>
                        </X509IssuerSerial>
                        <X509Certificate>
                            MIICOjCCAaMCAgPoMA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYTAlVTMRAwDgYD
                        </X509Certificate>
                    </X509Data>
                </KeyInfo>
            </Signature>
            <wsse:UsernameToken>
                <wsse:Username>test_user</wsse:Username>
                <wsse:Password>test_pass</wsse:Password>
            </wsse:UsernameToken>
            <wsu:Timestamp wsu:Id="id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
                <wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
                <wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
    </SOAP-ENV:Header>

    <ns0:Body wsu:Id="id-61b880d6-e56b-4cfc-bec6-471121c72547">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element">
            <xenc:EncryptionMethod
                Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
            <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
                    <xenc:EncryptedKey>
                        <xenc:EncryptionMethod
                        Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                        <xenc:CipherData>
                            <xenc:CipherValue>
                            KViKBt8yTp/ELA/vWWRhrGl86c/cCBORsmg5aYKctmFMfLMx8thU7acMC5TqpGzB
                            </xenc:CipherValue>
                        </xenc:CipherData>
                </xenc:EncryptedKey>
            </dsig:KeyInfo>
            <xenc:CipherData>
                <xenc:CipherValue>
                GPkZpozkWMISAkMJ8OuBuKE6wNLmsftEmK6tt5+0/EpY+TpWI8ffh7KWoxjHTGL6
                </xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>
    </ns0:Body>
</SOAP-ENV:Envelope>

通过"调试"（手动拼接签名加密处理的文档），我设法解密了。

正常的假设是订单与XML文档无关，但是XMLSEC似乎明确期望在EncryptionData内加密方法后立即期望键入。简单地交换加密数据Cipherdata和KeyInfo修复了它。

看起来XMLSEC并不是真正解析XML，而是表现出以下方式：

查找'EncryptedData'
查找'EncryptionMethod'
查找'keyInfo'
在此键内，找到它是嵌套的" cipherdata"块，找到'ciphervalue'
离开键
然后继续进行加密数据的密码块在KeyInfo。

相关内容

最新更新

热门标签：