Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday...
-
date post
19-Dec-2015 -
Category
Documents
-
view
217 -
download
1
Transcript of Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday...
![Page 1: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/1.jpg)
Web Services & Security
ir. Paul Brandt, TNO-ICT
Today, Friday January 13Next week, Friday January 20
![Page 2: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/2.jpg)
Web Services & Security
![Page 3: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/3.jpg)
Web Services
![Page 4: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/4.jpg)
What are Web Services?
Web pages for computersReality: heterogeneous systems,
platforms, dataReality: Processes change, be agile
to copeApplication: provides serviceRequest-responseLousely coupled
![Page 5: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/5.jpg)
What's its Significance?
Application IntegrationEAI, B2B, Automating Business
ProcessesUniversal Application Connectivity
![Page 6: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/6.jpg)
Universal Application Connectivity
Easy to access remote resourcesExpose business processes over the
WebInterface is standard, published,
discoverable, self-describing
![Page 7: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/7.jpg)
What are the Security Challenges?
Message orientedIdentities
![Page 8: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/8.jpg)
Message oriented
Web services typically use multi-hop communication paths
Transport level security (SSL, TLS, IPSEC, ...) only provides Point-2-Point (on-the-wire) confidentiality
Messages are decrypted in the servers (a.o. routing), violating confidentiality
Hence End-2-End, i.e. message based, confidentiality required
Combined approach is possible
![Page 9: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/9.jpg)
Identities
Web services transport potentially unkown identies into my platform
Who are they?Are they authorized?Assett protection: What critical
information is leaving my platform?Can it be proved they did these
things?
![Page 10: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/10.jpg)
XML-family
![Page 11: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/11.jpg)
XML-family
![Page 12: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/12.jpg)
XML basics
![Page 13: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/13.jpg)
XML Objective
Structured, self describing interface...
... totally independent application, protocol, vocabulary, operating system & programming language
Grammar & syntax to build interfaceNothing to do with semantics!!
![Page 14: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/14.jpg)
XML Characteristics
XML stores data within descriptive element tags: <PartNo>54-2345</PartNo>
Character-oriented, not binary, hence human-readable
Extensible Meta LanguageSeparates content from structure &
formAll family members are specified in
XML itself
![Page 15: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/15.jpg)
Example 1: Simple XML (1/1)
<Order>
<LineItem sku="82394" quantity="1">
<ProductName>Birdcage</ProductName>
<Model material="Iron" color="Blue" />
</LineItem>
<Amount Currency="USD">108.50</Amount>
<Customer id="customer" custNum="A2345">
<FirstName>Fred</FirstName>
<MiddleInit>L</MiddleInit>
<LastName>Jones</LastName>
<CreditCard>
<CreditCardType>VISA</CreditCardType>
<CreditCardNumber>43343456343566</CreditCardNumber>
<CreditCardExpiration>10/08</CreditCardExpiration>
</CreditCard>
</Customer>
</Order>
An Order
Element: Data enclosed by named tags:
<element>data</element>
Hierarchical: <Element> can contain other <Element>’s
Start-tag can contain attributes:attributeName=value
Reserved attributeNames:“id=” uniquely identifies
individual element
Empty element:no data, single <element/> tag
![Page 16: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/16.jpg)
XML Schema
XML document can be validated against schema, automatically
Schema defines hierarchical structure
Schema defines data typesSchema defines particular order of
elementsSchema provides for accurate &
consistent dataXML document = instance of defined
XML schema
![Page 17: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/17.jpg)
Example 2: XML Schema (1/1)
<xsd:schema xmlns:xsd="http://www.w3.org/1999/XMLSchema">
<xsd:element name="Order" type="order"/>
<xsd:complexType name="order">
<xsd:element name="LineItem" type="lineItemType"/>
<xsd:element name="Amount" type="amountType"/>
<xsd:element name="Customer" type="customerType"/>
</xsd:complexType>
<xsd:complexType name="lineItemType">
<xsd:element name="ProductName" type="xsd:string"/>
<xsd:element name="Model" type="modelType"/>
</xsd:complexType>
. . . etc., until all types correspond to simpleTypes
(integer, string, double, float, date and time)
</xsd:schema>
An Order
<Order>
<LineItem sku="82394" quantity="1">
<ProductName>Birdcage</ProductName>
<Model material="Iron" color="Blue" />
</LineItem>
<Amount Currency="USD">108.50</Amount>
<Customer id="customer" custNum="A2345">
<FirstName>Fred</FirstName>
<MiddleInit>L</MiddleInit>
<LastName>Jones</LastName>
<CreditCard>
<CCType>VISA</CCType>
<CCNumber> . . </CCNumber>
<CCExpiration>10/08</CCExpiration>
</CreditCard>
</Customer>
</Order>
![Page 18: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/18.jpg)
Namespaces
ProblemSolution: xmlns
![Page 19: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/19.jpg)
Problem
Anyone can define element namesHence, name collision and conflicts
all alongXML shall keep names separate and
distinct
![Page 20: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/20.jpg)
Solution: xmlns XML namespace (1/1)
xmlns:myns=“http://www.myorg.com/foo”
<myns:order>
<xsd:schema xmlns:xsd="http://www.w3.org/1999/XMLSchema">
<xsd:element name="Order" type="order"/>
<xsd:complexType name="order">
<xsd:element name="LineItem" type="lineItemType"/>
<xsd:element name="Amount" type="amountType"/>
<xsd:element name="Customer" type="customerType"/>
</xsd:complexType>
<xsd:complexType name="lineItemType">
<xsd:element name="ProductName" type="xsd:string"/>
<xsd:element name="Model" type="modelType"/>
</xsd:complexType>
. . . etc., until all types correspond to simpleTypes
(integer,
string, double, float, date and time)
</xsd:schema>
My unique namespace
Namespaces are uniform resource identifiers:1. Define unique name2. Prepend that to each & every element name
Abbreviated namespace:prefix
Reserved namespace:“namespace def coming up”
Unique element name
![Page 21: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/21.jpg)
XML Landscape
XML standards belonging to operation domain
XML standards belonging to XML Family (Security)
XML standards belonging to XML Family (general)
![Page 22: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/22.jpg)
XML standards belonging to operation domain
hrXML - XML for Human Resource (employment agencies)
X4ML - XML for Merrill LynchHL-7v3: XML message format for
Health Care....really, really big landscape
![Page 23: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/23.jpg)
XML standards belonging to XML Family (Security)
SOAP - Simple Object Access Protocol
XML-Signature XML-Encryption SAML - Security Assertion
Markup Language XACML - eXtensible Access
Control Markup Language XrML - eXtensible Rights
ML XKMS - XML Key
Management Specification WS-Security WS-Policy
![Page 24: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/24.jpg)
XML standards belonging to XML Family (general)
WS-*: Web Service standardsWSDL - Web Services Description
LanguageXSL(T) - eXtensible Stylesheet
Language (Transformations)XPath
![Page 25: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/25.jpg)
XML-Signature
![Page 26: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/26.jpg)
XML-Signature
![Page 27: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/27.jpg)
Objective
Integrity of resourceIdentity of originatorNon-repudiation of eventFoundation from Digital Signature
![Page 28: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/28.jpg)
Foundation from Digital Signature
Greatly expands upon it:Uses power and flexibility of XML ...... as well as key Web technologies
(such as URLs) ...to sign almost any type of resource:
![Page 29: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/29.jpg)
to sign almost any type of resource:
XML documentsParts thereofnon-XML object such as an imageas long as it has an URL
![Page 30: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/30.jpg)
XML-Signature structure
![Page 31: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/31.jpg)
Core
A set of pointers (references) to things to be signed
The actual signature(Optional) The key (or a way to look
up the key) for verifying the signature
(Optional) An Object tag for miscellaneous items not included in the first three items
![Page 32: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/32.jpg)
Example Sig1:Highly Simplified XML Signature (1/1)
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo> <Reference URI="http://www.foo.com/secureDocument.html" />
</SignedInfo>
<SignatureValue>...</SignatureValue>
<KeyInfo>... </KeyInfo>
</Signature>
actual signature bits
information about the key
Reference(s) to what is
being signed
![Page 33: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/33.jpg)
3 Types of XML-Signature
Enveloping SignaturesEnveloped SignaturesDetached Signatures
![Page 34: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/34.jpg)
Example Sig2:Simplified Enveloping Signatures (1/4)
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <Reference URI="#111" /> </SignedInfo> <SignatureValue>...</SignatureValue> <KeyInfo>...</KeyInfo> <Object>
<SignedItem id="111">Stuff to be signed</SignedItem> </Object></Signature>
![Page 35: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/35.jpg)
<PurchaseOrder id="po1"> <SKU>125356</SKU> <Quantity>17</Quantity> <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <Reference URI="#po1" /> </SignedInfo> <SignatureValue>...</SignatureValue> <KeyInfo>...</KeyInfo> </Signature></PurchaseOrder>
Example Sig2:Simplified Enveloped Signatures (2/4)
![Page 36: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/36.jpg)
Example Sig2:Detached Signatures (3/4)
internal resource
<PurchaseOrderDocument>
<PurchaseOrder id="po1"> <SKU>12366</SKU> <Quantity>17</SKU> </PurchaseOrder>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <Reference URI="#po1" /> </SignedInfo> <SignatureValue>...</SignatureValue> <KeyInfo>...</KeyInfo> </Signature>
</PurchaseOrderDocument>
![Page 37: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/37.jpg)
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <SignedInfo> <Reference URI="http://www.foo.com/Lion.jpg" /> <Reference URI="http://www.foo.com/Secure.txt" /> <Reference URI="http://www.foo.com/Secure.xml" /> </SignedInfo> <SignatureValue>...</SignatureValue> <KeyInfo>...</KeyInfo></Signature>
Example Sig2:Detached Signatures (4/4)
external resource
![Page 38: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/38.jpg)
The Bloody Details
![Page 39: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/39.jpg)
Core element 1/4: <SignedInfo>
1. Security model2. Canonicalization (c14n)3. Identify resource(s) to be signed
![Page 40: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/40.jpg)
1. Security model
No new security technologies were invented (Digital Signature)
But: Digital Signature == Integrity AND Identity
Hence: Public keys (asymmetrical: RSA, DSA) => integrity & identity
Keyed Hashed Authentication Code (symmetrical: HMAC) => ONLY integrity, NO identity
<SignatureMethod />
![Page 41: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/41.jpg)
2. Canonicalization (c14n)
2.1. c14n normalizes the XML2.2. c14n: What does it actually do?
![Page 42: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/42.jpg)
2.1. c14n normalizes the XML
regardless of inconsequential physical differences in the XML ...
... two logically equivalent XML documents ...
... will become physically, bit-to-bit equivalent.
This is a critical requirement for
digital signatures to work.
![Page 43: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/43.jpg)
2.2. c14n: What does it actually do?
The document is encoded in UTF-8.
Line breaks are normalized to #xA on input, before parsing.
Attribute values are normalized, as if by a validating processor.
Character and parsed entity references are replaced.
CDATA sections are replaced with their character content.
The XML declaration and Document Type Definition (DTD) are removed.
Empty elements are converted to start-end tag pairs.
Whitespace outside the document element and within start and end tags is normalized.
All whitespace in character content is retained (excluding characters removed during linefeed normalization).
Attribute value delimiters are set to quotation marks (double quotes).
Special characters in attribute values and character content are replaced by character references.
Superfluous namespace declarations are removed from each element.
Default attributes are added to each element.
Lexicographic order is imposed on the namespace declarations and attributes of each element.
![Page 44: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/44.jpg)
3. Identify resource(s) to be signed
Reference the resource(s) (enveloped/-ing/detached) using URI
Calculate (& include) Digest of referenced resource
(not before Transforms have been applied, such as c14n, XSLT, XPath)
<Reference URI ? > +
![Page 45: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/45.jpg)
<Reference URI ? > +
<Transforms> ?<DigestMethod><DigestValue>
![Page 46: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/46.jpg)
Core element 2/4: <SignatureValue>
NOT signature of resource itself!Digital signature of the
<SignedInfo> blockSignature Method, Resource
Reference & Resource DigestIndirect, but water tight signature of
resource
![Page 47: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/47.jpg)
Core element 3/4: <KeyInfo> ?
1. Can be omitted completely (assuming the receiver's got it already).
2. Provide a name to look up the key.
3. Provide the key in a raw form right in the XML.
4. Provide the key within a digital certificate.
Provides a variety of types of keys to support different cryptography standards.
Know your Keys! Verify!
![Page 48: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/48.jpg)
Know your Keys! Verify!
Key is Valid (CA)Key is not revoked(asym:) Represents the individual
![Page 49: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/49.jpg)
Core element 4/4: <Object> *
Type-attribute: 1 out of three:"Enveloping Signature: Here's your
data"A Manifest elementA SignatureProperties element
![Page 50: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/50.jpg)
Resulting Schema shorthand
<Signature><SignedInfo>
<CanonicalizationMethod><SignatureMethod> (<Reference URI ? >
<Transforms> ?<DigestMethod><DigestValue>
</Reference>)+ </SignedInfo>
<SignatureValue>
(<KeyInfo (id=)?> (<KeyName>)? (<KeyValue>)? (<RetrievalMethod>)? (<X509Data>)? (<PGPData>)? (<SPKIData>)? (<MgmtData>)?
<KeyInfo>)?
(<Object> (<Manifest (id=)?>
<Reference> +</Manifest>) ?(<SignatureProperties>
<SignatureProperty (id=)?> +</SignatureProperties>) ?
</Object> ) *</Signature>
![Page 51: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/51.jpg)
Best practices
![Page 52: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/52.jpg)
1. Transformations
1.1. Only what is signed, is secure (... and NOT that what has been
removed by Transform, but still present in resource!)
1.2. WYSIWYS (... hence: include XSL(T)-
stylesheet)1.3. Work on what is signed (... not on resource, but on
transformed resource)
![Page 53: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/53.jpg)
2. Security model
2.1. Know your Keys! Verify them!2.2. Public key signatures are primarily
associated with identity and integrity.2.3. Keyed hashed authentication codes
are shared key based, run much faster than public keys, however ONLY provides integrity, not identity
2.4. XML-Signature processing does not automatically sign <Object> elements within a <Signature> element: Only <SignedInfo> is signed!
![Page 54: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/54.jpg)
Summary
![Page 55: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/55.jpg)
XML-Encryption
![Page 56: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/56.jpg)
XML-Encryption
![Page 57: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/57.jpg)
Objective
![Page 58: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/58.jpg)
2. Message oriented
2.1. Web services typically use multi-hop communication paths
2.2. Transport level security (SSL, TLS, IPSEC, ...) only provides Point-2-Point (on-the-wire) confidentiality
2.3. Messages are decrypted in the servers (a.o. routing), violating confidentiality
2.4. Hence End-2-End, i.e. message based, confidentiality required
2.5. Combined approach is possible
![Page 59: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/59.jpg)
3. One document, Multiple views
3.1. Encrypt different sections3.2. Possibly with distinct keys3.3. Hence: different sections
mutually exclusive available for different target audiences
![Page 60: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/60.jpg)
4. Target resource
4.1. Internal encryption: Within current document (similar to Enveloping)
4.2. External encryption: external resource (similar to Detached)
... XML document... any other MIME-type document... as long as it has got a URL
![Page 61: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/61.jpg)
XML-Encryption structure
![Page 62: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/62.jpg)
Example Enc1:Highly Simplified XML-Encryption (1/1)
encapsulated by original <SSNo>
encapsulating original <Salary>
Binary, encrypted content
<MyDoc><Employee>
<SSNo>34569812612</SSNo><Name>Fred Jones</Name><Salary>$42.644</Salary><Manager>David Mischief</Manager>
</Employee></MyDoc>
<MyDoc><Employee>
<SSNo><EncryptedData>kjhGEuf7639Fh*e#j&2V</EncryptedData>
</SSNo><Name>Fred Jones</Name><EncryptedData>jHFnkeiuHF3#9jeGi$@kjg*KJGm,jF</EncryptedData><Manager>David Mischief</Manager>
</Employee></MyDoc>
![Page 63: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/63.jpg)
Core: <EncryptedData> element
Either wraps data within the XML document that is being encrypted
Or it points to something that has been encrypted
<EncryptedData> ..CipherData or ReferenceToCipherData.. </EncryptedData>
<EncryptedData>-element replaces original content
![Page 64: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/64.jpg)
The Bloody Details
![Page 65: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/65.jpg)
1. <EncryptedData>
![Page 66: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/66.jpg)
1.1. Purpose:
1.1.1. Overall tag, container for XML-Encryption structure
1.1.2. Can be placed anywhere in your XML resource
1.1.3. Represents: one single resource that has been encrypted
1.1.4. Encrypted data either encompassed or detached
![Page 67: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/67.jpg)
1.2. Attributes for <EncryptedData>
1.2.1. Id : one can refer to this <EncryptedData> element
1.2.2. Type="Content" or "Element":1.2.3. MIME Type :1.2.4. Encoding :1.2.5. All attributes are optional, in
practice Type always included
![Page 68: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/68.jpg)
1.2.2. Type="Content" or "Element":
Don't encrypt <element> tag
... <SSNo> tag encapsulates <EncryptedData> tag
Do encrypt <element> tag
... <EncryptedData>-element encapsulates disappeared <Salary> tag
![Page 69: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/69.jpg)
1.2.3. MIME Type :
To further describe the encrypted item, i.e. GIF image
MimeType='image/gif'
![Page 70: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/70.jpg)
1.2.4. Encoding :
To further describe the encrypted item, i.e. Base-64 character encoding
Because encrypted data is binary data...
... encoding describes method to encode binary encrypted data to character data ...
... to be able to insert it in an XML document
Encoding="http://www.w3.org/2000/09/xmldsig#base64"
![Page 71: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/71.jpg)
1.3. <EncryptedData> & Multiple views:
1.3.1. Define <EncryptedData> elements
1.3.2. Each is associated with one single key
1.3.3. Use N keys for N target audiences
![Page 72: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/72.jpg)
2. <EncryptionMethod/> ?
![Page 73: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/73.jpg)
3. <CipherData>
![Page 74: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/74.jpg)
4. <EncryptionProperties> ?
![Page 75: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/75.jpg)
5. <KeyInfo> ?
![Page 76: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/76.jpg)
5.1. Encryption key = symmetrical key: (1/4)
5.1.1. Speed 1000x faster than asymmetrical
5.1.2. Unlimited plain text size of target
5.1.3. Shared key encryption utilizes public key encryption to manage distribution of the shared key securely to the recipient
![Page 77: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/77.jpg)
5.2. <KeyInfo> element structure (2/4)
5.2.1. Identical to XML-Sig <KeyInfo>
5.2.2. Additional elements for key transport (<EncryptedKey>, <AgreementMethod>)
![Page 78: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/78.jpg)
5.3. Key Transport (3/4)
5.3.1. Leave out the key (assuming both sides already know the secret key).
5.3.2. Provide name or pointer to it (he's got it, but needs to know which one to select: <keyName> or <RetrievalMethod>)
5.3.3. Include encrypted symmetrical key:
5.3.4. Include hint to generate key:
![Page 79: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/79.jpg)
5.3.3. Include encrypted symmetrical key:
Uses asymmetrical key technology to transport symmetrical encryption key
<EncryptedKey> elementContains encrypted asymmetrical
keyIdentical to <EncryptedData>
structure & syntaxCan thus be recursive (!)Strategy is called "Digital
Enveloping"
![Page 80: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/80.jpg)
5.3.4. Include hint to generate key:
Uses "Key Agreement Protocol" to transport information to generate symm. key
Provide key generation algorithm, nonce, originator & recipient key info etc.
<AgreementMethod> element
![Page 81: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/81.jpg)
5.4. <ReferenceList> (4/4)
5.4.1. Lord of the Keys: "One Key to Rule Them All"
5.4.2. Efficiency: one <KeyInfo> block suffices
5.4.3. List of refs. to <EncryptedData> elements using this <KeyInfo>
![Page 82: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/82.jpg)
Super encryption
<EncryptedData> element encrypts other <EncryptedData> elements:
Fully recursiveApplies to entire <EncryptedData>
element(s), not its parts
![Page 83: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/83.jpg)
Resulting Schema shorthand
<EncryptedData Id? Type? MimeType? Encoding?><EncryptionMethod/>?<ds:KeyInfo>
<EncryptedKey>?<AgreementMethod>?<ds:KeyName>?<ds:RetrievalMethod>?<ds:*>?
</ds:KeyInfo>?<CipherData>
<CipherValue>? <CipherReference URI?>?
</CipherData><EncryptionProperties>?
</EncryptedData>
![Page 84: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/84.jpg)
Combining XML-Encryption with XML-Signature
![Page 85: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/85.jpg)
EncryptedData for SSNo.
Key (1) info belonging to Ciphered SSNo.
Example Enc & Sig 1: Protecting Integrity of <EncryptedData>(1/2)
Ciphered SSNo.
EncryptedData for Key
Encrypted Key to decrypt Ciphered SSNo.
Key (2) info belonging to Encrypted Key
Signed info refers to Encrypted Data for SSNo.
Digest of EncryptedData for SSNo.
Signature of SignedInfo
Key (3) info to verify Signature
![Page 86: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/86.jpg)
Example Enc & Sig 1: Protecting Integrity of <EncryptedData>(2/2)
Reasonable Statement
Iff:Confident keys are associated with sender & recipientAND private keys are not compromised
Then:“This document was prepared by David Remy and can only be read by Jothy Rosenberg”
![Page 87: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/87.jpg)
SfE: however...
<Signature> & <EncryptedData> are detached
<Signature> can be removed without being noticed
<Signature> can even be replaced: "Signed by David Copperfield"
Need Policy: If encrypted, then also signed
BTW: what's the order of processing ??
![Page 88: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/88.jpg)
Example Enc & Sig 2: Encryption follows Signing (1/3)
<Order> <LineItem sku="82394" quantity="1"> <ProductName>Birdcage</ProductName> </LineItem> <Customer id="customer" custNum="A2345"> <FirstName>Fred</FirstName> <MiddleInit>L</MiddleInit> <LastName>Jones</LastName> <CreditCard> <CreditCardType>VISA</CreditCardType> <CreditCardNumber>43343456343566</CreditCardNumber> <CreditCardExpiration>10/08</CreditCardExpiration> </CreditCard> </Customer></Order>
The original Order
![Page 89: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/89.jpg)
Example Enc & Sig 2: Encryption follows Signing (2/3)
<Order> <LineItem sku="82394" quantity="1"> <ProductName>Birdcage</ProductName> </LineItem> <Customer id="customer" custNum="A2345"> <Name . . . /> <CreditCard . . . /> <Signature> <SignedInfo> <CanonicalizationMethod Algorigthm=". . ." /> <SignatureMethod Algorithm=". . ." /> <Reference URI="#customer"> <Transform Algorithm=".../#envelopedSignature" /> <DigestMethod Algorithm=". . ." /> <DigestValue>. . .</DigestValue> </Reference> </SignedInfo> <SignatureValue>. . . </SignatureValue> <KeyInfo> <X509Data> <X509SubjectName>O=MyCompany,OU=Engineering,CN=David Remy</X509SubjectName> </X509Data> </KeyInfo> </Signature> </Customer></Order>
The Order, signed by David Remy
![Page 90: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/90.jpg)
Example Enc & Sig 2: Encryption follows Signing (3/3)
<Order> <LineItem sku="82394" quantity="1"> <ProductName>Birdcage</ProductName> </LineItem> <EncryptedData id="encryptedData1" Type="Element"> <EncryptionMethod Algorithm=". . ." /> <CipherText> <CipherValue>. . . </CipherValue> </CipherText> <KeyInfo> <EncryptedKey> <EncryptionMethod Algorithm=". . ." /> <CipherText> <CipherValue>. . .</CipherValue> </CipherText> <KeyInfo> <X509Data> <X509Subject>O=HisCompany,OU=Technology,CN=Jothy Rosenberg</X509Subject> </X509Data> </KeyInfo> </EncryptedKey> </KeyInfo> </EncryptedData></Order>
The signed order, <Customer> is element Encrypted
![Page 91: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/91.jpg)
EfS: however...
++ Signature, w/t sensitive data, invisible
++ Clear order of processing
-- Integrity of EncryptedData isn’t guaranteed
![Page 92: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/92.jpg)
In conclusion
Order of processing SfESecurity Model: SfE or EfS
![Page 93: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/93.jpg)
Order of processing SfE
Problem: What to do 1st, Decrypt or Validate Signature
Solution: additional 'Decrypt Transform' for XML-Signature
![Page 94: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/94.jpg)
Security Model: SfE or EfS
Depends on context, the specific situation
Specify a PolicyConsider multi-layered approach
SfEfS
![Page 95: Web Services & Security ir. Paul Brandt, TNO-ICT Today, Friday January 13 Next week, Friday January 20.](https://reader036.fdocuments.in/reader036/viewer/2022062714/56649d3a5503460f94a143da/html5/thumbnails/95.jpg)
Summary