What Is XML Encryption Syntax and Processing?

SOAP Web Service Tutorials - Herong's Tutorial Examples

∟What Is XML Encryption Syntax and Processing?

This section describes the XML Encryption Syntax and Processing specification developed by W3C that specifies a process for encrypting data and representing the result in XML.

What is "XML Encryption Syntax and Processing"? XML Encryption Syntax and Processing is a specification developed by W3C that specifies a process for encrypting data and representing the result in XML. The data may be arbitrary data (including an XML document), an XML element, or XML element content. The result of encrypting data is an XML Encryption EncryptedData element which contains (via one of its children's content) or identifies (via a URI reference) the cipher data.

The XML Encryption Syntax and Processing specification defines 2 XML structures:

"EncryptedData" Element Only - Data is encrypted with a secret key that is known to the send and the receiver. Or data is encrypted by the sender with the public key of the receiver. The encrypted data and key identification are included in the "EncryptedData" XML element.
"EncryptedData" and "EncryptedKey" Elements - Data is encrypted with a secret key randomly generated by the sender. The encrypted data is included in the "EncryptedData" XML element. And secret key is encrypted by the sender with the public key of the receiver. The encrypted secret key and the public key identification are included in the "EncryptedKey" element. This double encryption process is used because secret key (symmetric) encryption is much more efficient than public key encryption when encrypting large data.

Here is the structure of the "EncryptedData" element:

<EncryptedData xmlns='http://www.w3.org/2001/04/xmlenc#' 
   Type='...'/>

 <EncryptionMethod Algorithm='...'/>

 <ds:KeyInfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
  ...
 </ds:KeyInfo>

 <CipherData>
  <CipherValue>...</CipherValue>
 </CipherData>

</EncryptedData>

Notes on the above XML sybtax:

The attribute "EncryptedData[@Type]" indicates the type of data to be encrypted.
The attribute "EncryptedData/EncryptionMethod[@Algorithm]" indicates what algorithm is used to encrypt the data.
The sub element "EncryptedData/ds:KeyInfo" contains information about the key that is used to perform the encryption. The syntax of "ds:KeyInfo" is actually defined in the "XML Signature Syntax and Processing" specification.
The sub element "EncryptedData/CipherData/CipherValue" contains the actual encrypted data in Base64 format.

If the double encryption process is used, both EncryptedData" element and "EncryptedKey" element are included in parent XML element:

...
<EncryptedData Id='ED' xmlns='http://www.w3.org/2001/04/xmlenc#' 
   Type='...'/>

 <EncryptionMethod Algorithm='...'/>

 <ds:KeyInfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
  <ds:RetrievalMethod URI='#EK' 
   Type="http://www.w3.org/2001/04/xmlenc#EncryptedKey"/>
 </ds:KeyInfo>

 <CipherData>
  <CipherValue>...</CipherValue>
 </CipherData>

</EncryptedData>

...

<EncryptedKey Id='EK' xmlns='http://www.w3.org/2001/04/xmlenc#'>

<EncryptionMethod Algorithm="..."/>

<ds:KeyInfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
 ...
</ds:KeyInfo>

<CipherData>
 <CipherValue>...</CipherValue>
</CipherData>

<ReferenceList>
 <DataReference URI='#ED'/>
</ReferenceList>

<CarriedKeyName>Sally Doe</CarriedKeyName>

</EncryptedKey>
...

Notes on the above XML syntax:

The attribute "EncryptedData/ds:KeyInfo/ds:RetrievalMethod[@URI]" provides a fragment identifier pointing to a local XML element ID to identify an "EncryptedKey" element containing the encrypted secret key.
The attribute "EncryptedKey/EncryptionMethod[@Algorithm]" indicates what algorithm is used to encrypt the secret key.
The sub element "EncryptedKey/ds:KeyInfo" contains information about the public key that is used to perform the encryption.
The sub element "EncryptedKey/CipherData/CipherValue" contains the actual encrypted secret key in Base64 format.
The sub element "EncryptedKey/ReferenceList" contains a list of references pointing back to "EncryptedData" or "EncryptedKey" element that are using this encrypted key.
The sub element "EncryptedKey/CarriedKeyName" defines a name for this encrypted key as a reference used in other encryption elements.

"XML Encryption Syntax and Processing" specification can be used together with "WS-Security X.509 Certificate Token Profile" to protect the SOAP message confidentiality by encrypting a single or multiple parts of the SOAP message.

For more information on "XML Encryption Syntax and Processing", see the full specification at http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/.

Last update: 2014.

Table of Contents

About This Book

Introduction to Web Service

Introduction to SOAP (Simple Object Access Protocol)

SOAP Message Structure

SOAP Message Transmission and Processing

SOAP Data Model

SOAP Encoding

SOAP RPC Presentation

SOAP Properties Model