[OASIS Issue Tracker] Created: (SECURITY-16) PE: Mitigation for XML Encryption CBC deficiencies

[OASIS Issues Tracker <workgroup_mailer@lists.oasis-open.org>]

PE: Mitigation for XML Encryption CBC deficiencies
--------------------------------------------------

                 Key: SECURITY-16
                 URL: http://tools.oasis-open.org/issues/browse/SECURITY-16
             Project: OASIS Security Services (SAML) TC
          Issue Type: Improvement
          Components: Core
    Affects Versions: Version 2.0
            Reporter: Scott Cantor
             Fix For: 2.0 incorporating Approved Errata


A published paper (http://www.nds.rub.de/media/nds/veroeffentlichungen/2011/10/22/HowToBreakXMLenc.pdf) has described vulnerabilities in the use of CBC algorithms for data encryption when the ciphertext is not integrity-protected. The algorithms that provide built-in protection are not widely implemented yet, and the most effective mitigation for SAML implementations is to encourage the use of XML Signature or transport authentication at a layer above the use of XML Encryption. In particular, the ability to sign Responses (and require their use) is an effective strategy in many SAML profles. This is to some extent a reversal of conventional wisdom that it's more efficient and just as secure to limit signing to the Assertion layer (and then encrypt the result).

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://tools.oasis-open.org/issues/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira