我使用了PIP中的py-wsse,但它似乎坏了。我已经将其重构/修复为
在添加了我无法使用的WSSE组件之后,我能够使用普通的旧XMLSEC对其进行加密/解密。
基础导入是xmlsec(1.35)和OpenSSL。加密/解密由xmlsec执行,密钥/证书的生成由openssl完成。使用这些证书/密钥文件进行签名是由xmlsec完成的。
我对xmlsec签名的文档进行预处理/后期处理以创建wsse文档。同样,在解密时,我会处理文档以将密钥信息移回EncryptedData块
这是我的签名和加密文档,据我所知,加密数据块看起来与我的原始XMLSEC文档以及其他一些附加标签相同。无法解密。
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ns1="http://hcv.health.ontario.ca/"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<SOAP-ENV:Header>
<wsse:Security mustUnderstand="true">
<wsse:BinarySecurityToken
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
wsu:Id="id-12e0aebc-9024-476f-a43a-5666e9ea2838">
__cipher__text__here__
</wsse:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
<Transforms>
<Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>qW0RXziKgv89NQN1Jh3r6GiE68k=</DigestValue>
</Reference>
<Reference URI="#id-392912e7-0b10-4243-86ea-836e13e445f0">
<Transforms>
<Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>2RT70EVr3SxEQIsYFRTlCv+E/VQ=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>
__cipher__text__here__
</SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference>
<X509Data>
<X509IssuerSerial>
<X509IssuerName>
CN=example.com
</X509IssuerName>
<X509SerialNumber>1000</X509SerialNumber>
</X509IssuerSerial>
<X509Certificate>
__cipher__text__here__
</X509Certificate>
</X509Data>
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
<wsu:Timestamp wsu:Id="id-392912e7-0b10-4243-86ea-836e13e445f0">
<wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
<wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
</wsu:Timestamp>
</wsse:Security>
</SOAP-ENV:Header>
<ns0:Body wsu:Id="id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Type="http://www.w3.org/2001/04/xmlenc#Element"
wsu:Id="id-2ba0c3b4-7784-415d-aeca-08a45d504660">
<xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<xenc:EncryptedKey>
<xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
<xenc:CipherData>
<xenc:CipherValue>
__cipher__text__here__
</xenc:CipherValue>
</xenc:CipherData>
<xenc:ReferenceList>
<xenc:DataReference
URI="#id-2ba0c3b4-7784-415d-aeca-08a45d504660"/>
</xenc:ReferenceList>
</xenc:EncryptedKey>
</ds:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>
__cipher__text__here__
</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</ns0:Body>
</SOAP-ENV:Envelope>
这里是“原始XMLSEC”签名和加密的文档,可以解密:
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ns1="http://example.com/"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<SOAP-ENV:Header>
<wsse:Security mustUnderstand="true">
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#id-61b880d6-e56b-4cfc-bec6-471121c72547">
<Transforms>
<Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>NvKgiRH+6Q/xMSJxx/7qtkc+IFY=</DigestValue>
</Reference>
<Reference URI="#id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
<Transforms>
<Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>5IoUfViIk5hJTt3Whl7I/jFq+Ww=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>
RmbXCTcji8c0ZWuRrCYdBL57FtGiwmX5HlZIol1k/d7d8PIdj0YR/41qP7DlSTD2
fspVNXLYc9kEh+YbTbodRsGvHQ/ZUWhXC6dX3/1BjdxrycPcQI37REIO+btla5wR
Icn5FvXMHPPJfln9y3ulj/RAjHU44nDKE4m0zWJ8lUo=
</SignatureValue>
<KeyInfo>
<X509Data>
<X509IssuerSerial>
<X509IssuerName>
CN=example.com
</X509IssuerName>
<X509SerialNumber>1000</X509SerialNumber>
</X509IssuerSerial>
<X509Certificate>
MIICOjCCAaMCAgPoMA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYTAlVTMRAwDgYD
</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
<wsse:UsernameToken>
<wsse:Username>test_user</wsse:Username>
<wsse:Password>test_pass</wsse:Password>
</wsse:UsernameToken>
<wsu:Timestamp wsu:Id="id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
<wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
<wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
</wsu:Timestamp>
</wsse:Security>
</SOAP-ENV:Header>
<ns0:Body wsu:Id="id-61b880d6-e56b-4cfc-bec6-471121c72547">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Type="http://www.w3.org/2001/04/xmlenc#Element">
<xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<xenc:EncryptedKey>
<xenc:EncryptionMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
<xenc:CipherData>
<xenc:CipherValue>
KViKBt8yTp/ELA/vWWRhrGl86c/cCBORsmg5aYKctmFMfLMx8thU7acMC5TqpGzB
</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedKey>
</dsig:KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>
GPkZpozkWMISAkMJ8OuBuKE6wNLmsftEmK6tt5+0/EpY+TpWI8ffh7KWoxjHTGL6
</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</ns0:Body>
</SOAP-ENV:Envelope>
答案 0 :(得分:0)
通过“调试”(手动拼接经过签名+加密+处理的文档),我设法对其进行了解密。
通常的假设是,顺序与XML文档无关,但是XMLSEC似乎明确期望在EncryptionData中的Encryption Method之后立即期望KeyInfo。 简单地交换加密数据CipherData和KeyInfo即可解决此问题。
XMLSEC似乎并没有真正解析XML,相反,它很可能表现如下:
查找“ EncryptedData”
找到“加密方法”
找到“ KeyInfo”
在此KeyInfo中,找到它的嵌套“ CipherData”块,找到 'CipherValue'
退出KeyInfo
然后进入加密数据的CipherData块,该块为 在KeyInfo之外。