.NET System Encryption for Bouncy Castle Java Decryption Throws Error

Question

A tough question, but I could use any help.

I use System.Security.Cryptography.Xml at my end to encrypt the SAML XML blog.

Encryption works fine, however, when it gets to the java library on the other hand, they get an error:

java.lang.ArrayIndexOutOfBoundsException: too much data for RSA block at org.bouncycastle.jce.provider.JCERSACipher.engineDoFinal(Unknown Source) at org.bouncycastle.jce.provider.WrapCipherSpi.engineUnwrap(Unknown Source) at javax.crypto.Cipher.unwrap(Unknown Source) at org.apache.xml.security.encryption.XMLCipher.decryptKey(Unknown Source) at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:680) at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:611) at org.opensaml.xml.encryption.Decrypter.decryptUsingResolvedEncryptedKey(Decrypter.java:761) at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:512) at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:439) at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:400) at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:141) at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:69) 

How can I continue to use my encryption method:

  public XmlElement EncryptXml(XmlElement assertion, X509Certificate2 cert) { //cert = new X509Certificate2(@"C:\temp\SEI.cer"); XmlElement returnElement; EncryptedData message = new EncryptedData(); message.Type = "http://www.w3.org/2001/04/xmlenc#Element"; message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES128KeyWrapUrl); //message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES128KeyWrapUrl); EncryptedKey key = new EncryptedKey(); key.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url); key.KeyInfo.AddClause(new KeyInfoX509Data(cert)); var rKey = new RijndaelManaged(); rKey.BlockSize = 128; rKey.KeySize = 128; rKey.Padding = PaddingMode.PKCS7; rKey.Mode = CipherMode.CBC; key.CipherData.CipherValue = EncryptedXml.EncryptKey(rKey.Key, (RSA)cert.PublicKey.Key, false); KeyInfoEncryptedKey keyInfo = new KeyInfoEncryptedKey(key); message.KeyInfo.AddClause(keyInfo); message.CipherData.CipherValue = new EncryptedXml().EncryptData(assertion, rKey, false); returnElement = message.GetXml(); Logger("Cert Size: " + System.Text.ASCIIEncoding.Unicode.GetByteCount(cert.ToString())); GetBytesKeyAndData(rKey, assertion.InnerText); return returnElement; } 

During a workaround for this error? Is there a parameter in EncryptedKey to set the fill size? Or do I need to use Bouncy Castle to indicate the size of the encrypted data?

Answer 1

I resized keywrapurl to encrypt AES RSA key.

I still don’t understand how encryption works in the opensaml java library, and after hacking it opens. I am amazed at how long it takes to set up a simple test envrionment in java.

Moral of the story: do not use asymmetric encryption for large amounts of data.

 public XmlElement EncryptXml(XmlElement assertion, X509Certificate2 cert) { //cert = new X509Certificate2(@"C:\temp\SEI.cer"); XmlElement returnElement; EncryptedData message = new EncryptedData(); message.Type = "http://www.w3.org/2001/04/xmlenc#Element"; message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES256KeyWrapUrl); //message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES128KeyWrapUrl); EncryptedKey key = new EncryptedKey(); key.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url); key.KeyInfo.AddClause(new KeyInfoX509Data(cert)); var rKey = new RijndaelManaged(); rKey.BlockSize = 128; rKey.KeySize = 128; rKey.Padding = PaddingMode.PKCS7; rKey.Mode = CipherMode.CBC; key.CipherData.CipherValue = EncryptedXml.EncryptKey(rKey.Key, (RSA)cert.PublicKey.Key, false); KeyInfoEncryptedKey keyInfo = new KeyInfoEncryptedKey(key); message.KeyInfo.AddClause(keyInfo); message.CipherData.CipherValue = new EncryptedXml().EncryptData(assertion, rKey, false); returnElement = message.GetXml(); Logger("Cert Size: " + System.Text.ASCIIEncoding.Unicode.GetByteCount(cert.ToString())); GetBytesKeyAndData(rKey, assertion.InnerText); return returnElement; }