为什么不能解密此xmlsec加密的WSSE增强的soap消息?

时间:2019-02-28 17:58:06

标签: python soap pyopenssl wsse xmlsec

我使用了PIP中的py-wsse,但它似乎坏了。我已经将其重构/修复为

  1. 添加X509标准:带签名的签名块,并通过证书使用公/私钥
  2. 在添加了我无法使用的WSSE组件之后,我能够使用普通的旧XMLSEC对其进行加密/解密。

  3. 基础导入是xmlsec(1.35)和OpenSSL。加密/解密由xmlsec执行,密钥/证书的生成由openssl完成。使用这些证书/密钥文件进行签名是由xmlsec完成的。

  4. 我对xmlsec签名的文档进行预处理/后期处理以创建wsse文档。同样,在解密时,我会处理文档以将密钥信息移回EncryptedData块

这是我的签名和加密文档,据我所知,加密数据块看起来与我的原始XMLSEC文档以及其他一些附加标签相同。无法解密。

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns1="http://hcv.health.ontario.ca/"
                   xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Header>
        <wsse:Security mustUnderstand="true">
            <wsse:BinarySecurityToken
                    EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
                    ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
                    wsu:Id="id-12e0aebc-9024-476f-a43a-5666e9ea2838">
                __cipher__text__here__
            </wsse:BinarySecurityToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod
                            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod
                            Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>qW0RXziKgv89NQN1Jh3r6GiE68k=</DigestValue>
                    </Reference>
                    <Reference URI="#id-392912e7-0b10-4243-86ea-836e13e445f0">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>2RT70EVr3SxEQIsYFRTlCv+E/VQ=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>
                    __cipher__text__here__
                </SignatureValue>
                <KeyInfo>
                    <wsse:SecurityTokenReference>
                        <X509Data>
                            <X509IssuerSerial>
                                <X509IssuerName>
                                    CN=example.com
                                </X509IssuerName>
                                <X509SerialNumber>1000</X509SerialNumber>
                            </X509IssuerSerial>
                            <X509Certificate>
                            __cipher__text__here__
                            </X509Certificate>
                        </X509Data>
                    </wsse:SecurityTokenReference>
                </KeyInfo>
            </Signature>
            <wsu:Timestamp wsu:Id="id-392912e7-0b10-4243-86ea-836e13e445f0">
                <wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
                <wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
    </SOAP-ENV:Header>
    <ns0:Body wsu:Id="id-f147f091-fef5-4f6a-a8fc-50cd1199280a">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element"
                            wsu:Id="id-2ba0c3b4-7784-415d-aeca-08a45d504660">
            <xenc:EncryptionMethod
                    Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>

            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <xenc:EncryptedKey>
                    <xenc:EncryptionMethod
                            Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                    <xenc:CipherData>
                        <xenc:CipherValue>
                            __cipher__text__here__
                        </xenc:CipherValue>
                    </xenc:CipherData>
                    <xenc:ReferenceList>
                        <xenc:DataReference
                                URI="#id-2ba0c3b4-7784-415d-aeca-08a45d504660"/>
                    </xenc:ReferenceList>
                </xenc:EncryptedKey>
            </ds:KeyInfo>

            <xenc:CipherData>
                <xenc:CipherValue>
                    __cipher__text__here__
                </xenc:CipherValue>
            </xenc:CipherData>

        </xenc:EncryptedData>
    </ns0:Body>
</SOAP-ENV:Envelope>

这里是“原始XMLSEC”签名和加密的文档,可以解密:

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"
                   xmlns:ns1="http://example.com/"
                   xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <SOAP-ENV:Header>
        <wsse:Security mustUnderstand="true">
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod
                            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod
                            Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#id-61b880d6-e56b-4cfc-bec6-471121c72547">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>NvKgiRH+6Q/xMSJxx/7qtkc+IFY=</DigestValue>
                    </Reference>
                    <Reference URI="#id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
                        <Transforms>
                            <Transform
                                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod
                                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>5IoUfViIk5hJTt3Whl7I/jFq+Ww=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>
                    RmbXCTcji8c0ZWuRrCYdBL57FtGiwmX5HlZIol1k/d7d8PIdj0YR/41qP7DlSTD2
                    fspVNXLYc9kEh+YbTbodRsGvHQ/ZUWhXC6dX3/1BjdxrycPcQI37REIO+btla5wR
                    Icn5FvXMHPPJfln9y3ulj/RAjHU44nDKE4m0zWJ8lUo=
                </SignatureValue>
                <KeyInfo>
                    <X509Data>
                        <X509IssuerSerial>
                            <X509IssuerName>
                                CN=example.com
                            </X509IssuerName>
                            <X509SerialNumber>1000</X509SerialNumber>
                        </X509IssuerSerial>
                        <X509Certificate>
                            MIICOjCCAaMCAgPoMA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYTAlVTMRAwDgYD
                        </X509Certificate>
                    </X509Data>
                </KeyInfo>
            </Signature>
            <wsse:UsernameToken>
                <wsse:Username>test_user</wsse:Username>
                <wsse:Password>test_pass</wsse:Password>
            </wsse:UsernameToken>
            <wsu:Timestamp wsu:Id="id-6b86d1cc-0d2b-42a8-ad1e-78e9448f9983">
                <wsu:Created>2017-07-18T01:32:47.577170+00:00</wsu:Created>
                <wsu:Expires>2017-07-18T01:34:17.577170+00:00</wsu:Expires>
            </wsu:Timestamp>
        </wsse:Security>
    </SOAP-ENV:Header>



    <ns0:Body wsu:Id="id-61b880d6-e56b-4cfc-bec6-471121c72547">
        <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                            Type="http://www.w3.org/2001/04/xmlenc#Element">
            <xenc:EncryptionMethod
                Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>

            <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
                    <xenc:EncryptedKey>
                        <xenc:EncryptionMethod
                        Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                        <xenc:CipherData>
                            <xenc:CipherValue>
                            KViKBt8yTp/ELA/vWWRhrGl86c/cCBORsmg5aYKctmFMfLMx8thU7acMC5TqpGzB
                            </xenc:CipherValue>
                        </xenc:CipherData>
                </xenc:EncryptedKey>
            </dsig:KeyInfo>

            <xenc:CipherData>
                <xenc:CipherValue>
                GPkZpozkWMISAkMJ8OuBuKE6wNLmsftEmK6tt5+0/EpY+TpWI8ffh7KWoxjHTGL6
                </xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>

    </ns0:Body>
</SOAP-ENV:Envelope>

1 个答案:

答案 0 :(得分:0)

通过“调试”(手动拼接经过签名+加密+处理的文档),我设法对其进行了解密。

通常的假设是,顺序与XML文档无关,但是XMLSEC似乎明确期望在EncryptionData中的Encryption Method之后立即期望KeyInfo。 简单地交换加密数据CipherData和KeyInfo即可解决此问题。

XMLSEC似乎并没有真正解析XML,相反,它很可能表现如下:

  1. 查找“ EncryptedData”

  2. 找到“加密方法”

  3. 找到“ KeyInfo”

  4. 在此KeyInfo中,找到它的嵌套“ CipherData”块,找到 'CipherValue'

  5. 退出KeyInfo

  6. 然后进入加密数据的CipherData块,该块为 在KeyInfo之外。