为什么我不能解密这个xmlsec加密的WSSE增强型肥皂消息？

问题描述 投票：0回答：1

我使用了PIP中的py-wsse，但似乎已经坏了。我已经重构/修复了它

  1. 添加X509标准：带签名的签名块，以及通过证书使用的公钥/私钥
  2. 在添加了WSSE组件之后，我无法使用普通的旧XMLSEC加密/解密它。
  3. 底层导入是xmlsec（1.35）和OpenSSL。加密/解密由xmlsec执行，密钥/证书生成由openssl完成。使用这些证书/密钥文件进行签名由xmlsec完成。
  4. 我在xmlsec签名文档上进行预处理/后期处理以创建wsse文档。同样，当我解密时，我处理文档以将密钥信息移回加密数据块

这是我的签名和加密文档，据我所知，加密数据块看起来与我的vanilla XMLSEC文档相同，除了一些额外的标签。这不能解密。

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns1="http://hcv.health.ontario.ca/"
                   xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Header>
        <wsse:Security mustUnderstand="true">
            <wsse:BinarySecurityToken
                    EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
                    ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
                    wsu:Id="id-12e0aebc-9024-476f-a43a-5666e9ea2838">
                __cipher__text__here__
            </wsse:BinarySecurityToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod
                            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod
                            Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>qW0RXziKgv89NQN1Jh3r6GiE68k=</DigestValue>
                    </Reference>
                    <Reference URI="#id-392912e7-0b10-4243-86ea-836e13e445f0">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>2RT70EVr3SxEQIsYFRTlCv+E/VQ=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>
                    __cipher__text__here__
                </SignatureValue>
                <KeyInfo>
                    <wsse:SecurityTokenReference>
                        <X509Data>
                            <X509IssuerSerial>
                                <X509IssuerName>
                                    CN=example.com
                                </X509IssuerName>
                                <X509SerialNumber>1000</X509SerialNumber>
                            </X509IssuerSerial>
                            <X509Certificate>
                            __cipher__text__here__
                            </X509Certificate>
                        </X509Data>
                    </wsse:SecurityTokenReference>
                </KeyInfo>
            </Signature>
            <wsu:Timestamp wsu:Id="id-392912e7-0b10-4243-86ea-836e13e445f0">
                <wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
                <wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
    </SOAP-ENV:Header>
    <ns0:Body wsu:Id="id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element"
                            wsu:Id="id-2ba0c3b4-7784-415d-aeca-08a45d504660">
            <xenc:EncryptionMethod
                    Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>

            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <xenc:EncryptedKey>
                    <xenc:EncryptionMethod
                            Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                    <xenc:CipherData>
                        <xenc:CipherValue>
                            __cipher__text__here__
                        </xenc:CipherValue>
                    </xenc:CipherData>
                    <xenc:ReferenceList>
                        <xenc:DataReference
                                URI="#id-2ba0c3b4-7784-415d-aeca-08a45d504660"/>
                    </xenc:ReferenceList>
                </xenc:EncryptedKey>
            </ds:KeyInfo>

            <xenc:CipherData>
                <xenc:CipherValue>
                    __cipher__text__here__
                </xenc:CipherValue>
            </xenc:CipherData>

        </xenc:EncryptedData>
    </ns0:Body>
</SOAP-ENV:Envelope>

这里是“vanilla XMLSEC”签名和加密文档，这个可以解密：

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns1="http://example.com/"
                   xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Header>
        <wsse:Security mustUnderstand="true">
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod
                            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod
                            Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#id-61b880d6-e56b-4cfc-bec6-471121c72547">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>NvKgiRH+6Q/xMSJxx/7qtkc+IFY=</DigestValue>
                    </Reference>
                    <Reference URI="#id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>5IoUfViIk5hJTt3Whl7I/jFq+Ww=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>
                    RmbXCTcji8c0ZWuRrCYdBL57FtGiwmX5HlZIol1k/d7d8PIdj0YR/41qP7DlSTD2
                    fspVNXLYc9kEh+YbTbodRsGvHQ/ZUWhXC6dX3/1BjdxrycPcQI37REIO+btla5wR
                    Icn5FvXMHPPJfln9y3ulj/RAjHU44nDKE4m0zWJ8lUo=
                </SignatureValue>
                <KeyInfo>
                    <X509Data>
                        <X509IssuerSerial>
                            <X509IssuerName>
                                CN=example.com
                            </X509IssuerName>
                            <X509SerialNumber>1000</X509SerialNumber>
                        </X509IssuerSerial>
                        <X509Certificate>
                            MIICOjCCAaMCAgPoMA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYTAlVTMRAwDgYD
                        </X509Certificate>
                    </X509Data>
                </KeyInfo>
            </Signature>
            <wsse:UsernameToken>
                <wsse:Username>test_user</wsse:Username>
                <wsse:Password>test_pass</wsse:Password>
            </wsse:UsernameToken>
            <wsu:Timestamp wsu:Id="id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
                <wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
                <wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
    </SOAP-ENV:Header>



    <ns0:Body wsu:Id="id-61b880d6-e56b-4cfc-bec6-471121c72547">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element">
            <xenc:EncryptionMethod
                Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>

            <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
                    <xenc:EncryptedKey>
                        <xenc:EncryptionMethod
                        Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                        <xenc:CipherData>
                            <xenc:CipherValue>
                            KViKBt8yTp/ELA/vWWRhrGl86c/cCBORsmg5aYKctmFMfLMx8thU7acMC5TqpGzB
                            </xenc:CipherValue>
                        </xenc:CipherData>
                </xenc:EncryptedKey>
            </dsig:KeyInfo>

            <xenc:CipherData>
                <xenc:CipherValue>
                GPkZpozkWMISAkMJ8OuBuKE6wNLmsftEmK6tt5+0/EpY+TpWI8ffh7KWoxjHTGL6
                </xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>

    </ns0:Body>
</SOAP-ENV:Envelope>
python soap pyopenssl wsse xmlsec
1个回答
0
投票

通过“调试”（手动拼接Signed + Encrypted + Processed文档），我设法解密它。

正常的假设是XML文档中的顺序无关紧要，但XMLSEC似乎明确期望在EncryptionData中的加密方法之后立即期望KeyInfo。加密数据的简单交换CipherData和KeyInfo修复了它。

看来XMLSEC并不是真正解析XML，而是最有可能表现如下：

  1. 找到'EncryptedData'
  2. 找到'EncryptionMethod'
  3. 找到'KeyInfo'
  4. 在这个KeyInfo中，找到它嵌套的'CipherData'块，找到'CipherValue'
  5. 退出KeyInfo
  6. 然后转到KeyInfo之外的加密数据的CipherData块。
最新问题
© www.soinside.com 2019 - 2024. All rights reserved.