xml-encryption

To help you get started, we've collected the most common ways that xml-encryption is being used within popular public projects.

tngan / samlify / lib / SamlLib.js View on Github

decryptAssertion: function decryptAssertion(type, here, from, entireXML, callback) {
      // Implement decryption first then check the signature
      if(entireXML) {
        // Perform encryption depends on the setting of where the message is sent, default is false
        if(type === 'SAMLResponse' && from.entitySetting.isAssertionEncrypted) {
          var hereSetting = here.entitySetting;
          // callback should be function (res) { ... }
          var parseEntireXML = new dom().parseFromString(entireXML);
          var encryptedDataNode = getEntireBody(parseEntireXML, 'EncryptedData');
          var encryptedData = encryptedDataNode !== undefined ? Utility.parseString(encryptedDataNode.toString()) : '';

          if(encryptedData === '') throw new Error('Undefined assertion or invalid syntax');
          xmlenc.decrypt(encryptedData, {
            key: Utility.readPrivateKeyFromFile(hereSetting.privateKeyFile, hereSetting.privateKeyFilePass), // use this entity's private to decrypt
          }, function(err, res) {
            if(err) throw new Error('Exception in decryptAssertion ' + err);
            if (res) {
              callback(parseEntireXML.toString().replace('', '').replace('', '').replace(encryptedData, res));
            } else {
              throw new Error('Undefined encrypted assertion');
            }
          });
        } else {
          callback(entireXML); // No need to do encrpytion
        }
      } else {
        throw new Error('Empty or undefined xml string');
      }
    }

View more ways to use xml-encryption

W3C XML Encryption implementation for node.js (https://www.w3.org/TR/xmlenc-core/)

Supports node >= 12

Usage

npm install xml-encryption

encrypt

var xmlenc = require('xml-encryption');

var options = {
  rsa_pub: fs.readFileSync(__dirname + '/your_rsa.pub'),
  pem: fs.readFileSync(__dirname + '/your_public_cert.pem'),
  encryptionAlgorithm: 'https://www.w3.org/2001/04/xmlenc#aes256-cbc',
  keyEncryptionAlgorithm: 'https://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
  disallowEncryptionWithInsecureAlgorithm: true,
  warnInsecureAlgorithm: true
};

xmlenc.encrypt('content to encrypt', options, function(err, result) {
    console.log(result);
}

Result:

  
    
      
        
          
        
        
          MIIEDzCCAveg... base64 cert... q3uaLvlAUo=
        
        
          sGH0hhzkjmLWYYY0gyQMampDM... encrypted symmetric key ...gewHMbtZafk1MHh9A==
        
      
    
    
        V3Vb1vDl055Lp92zvK..... encrypted content.... kNzP6xTu7/L9EMAeU
    

decrypt

var options = {
    key: fs.readFileSync(__dirname + '/your_private_key.key'),
    disallowDecryptionWithInsecureAlgorithm: true,
    warnInsecureAlgorithm: true
};

xmlenc.decrypt('', options, function(err, result) {
    console.log(result);
}

// result

decrypted content

Supported algorithms

Currently the library supports:

• EncryptedKey to transport symmetric key using:

  • https://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
  • https://www.w3.org/2001/04/xmlenc#rsa-1_5 (Insecure Algorithm)

• EncryptedData using:

  • https://www.w3.org/2001/04/xmlenc#aes128-cbc
  • https://www.w3.org/2001/04/xmlenc#aes256-cbc
  • https://www.w3.org/2009/xmlenc11#aes128-gcm
  • https://www.w3.org/2009/xmlenc11#aes256-gcm
  • https://www.w3.org/2001/04/xmlenc#tripledes-cbc (Insecure Algorithm)

Insecure Algorithms can be disabled via disallowEncryptionWithInsecureAlgorithm/disallowDecryptionWithInsecureAlgorithm flags when encrypting/decrypting. This flag is off by default in 0.x versions.

A warning will be piped to stderr using console.warn() by default when the aforementioned algorithms are used. This can be disabled via the warnInsecureAlgorithm flag.

Issue Reporting

If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Author

Auth0

License

This project is licensed under the MIT license. See the LICENSE file for more info.

Releases

Release notes may be found under github release page: https://github.com/auth0/node-xml-encryption/releases