swedenconnect/opensaml-security-ext

Security and crypto extensions to OpenSAML

opensaml-security-ext's Issues

Upgrade to OpenSAML 3.4.3

The current version has dependencies to OpenSAML 3.4.2. We should update to OpenSAML 3.4.3.

Change ConcatKDFParamaters to work with unpadded bit data

Currently, the ConcatKDFParameters class assumes that the parameters it receives in its ctor and setters are padded according to the rules for ConcatKDF. We should change this ...

Remove registration of named curves

OpenSAML 5 (opensaml-security-api) has support for these ...

Security bootstrap classes for SAML2Int and eIDAS

SAML2Int and eIDAS suggest default algorithms for signing and encryption. OpenSAML's DefaultSecurityConfigurationBootstrap class declares OpenSAML-defaults. We should make corresponding classes for SAML2Int and eIDAS.

Don't include xenc11:MGF element under EncryptedKey

Some client have hade interop-issues if the xenc11:MGF is included under the EncryptionMethod element.

See if we can add a configuration flag to exclude the element...

Upgrade to OpenSAML 5.1.2

Upgrade to OpenSAML 5.1.2.

Wrong RSA mode in RSA-PSS implementation for HSM

RSA mode used for RSS-PSS signing operation is using RSA Encrypt mode.

This works with SoftHSM but recent tests has demonstrated problem with other HSM vendors. This is caused by the fact that encrypt operation is the operation of RSA using the public key while decrypt is the equivalent operation with the private key. Since signing is an operation with the private key, the raw RSA transform must be done in decrypt mode.

Incompatibility with Java 17.0.10

When using Java 17.0.10 and a PKCS11 HSM, signatures can no longer be created. This is a stacktrace from the German eIDAS Middleware when it tries to sign the metadata:

2024-03-11T13:50:35.518Z ERROR 7 --- [nio-8443-exec-1] d.g.e.e.MetadataServiceImpl              : Cannot create metadata for this middleware
 org.opensaml.xmlsec.signature.support.SignatureException: Signature computation error
 	at org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl.signObject(ApacheSantuarioSignerProviderImpl.java:67) ~[opensaml-xmlsec-impl-5.0.0.jar!/:?]
 	at se.swedenconnect.opensaml.xmlsec.signature.support.provider.ExtendedSignerProvider.signObject(ExtendedSignerProvider.java:111) ~[opensaml-security-ext-4.0.0.jar!/:?]
 	at org.opensaml.xmlsec.signature.support.Signer.signObjects(Signer.java:64) ~[opensaml-xmlsec-api-5.0.0.jar!/:?]
 	at de.governikus.eumw.eidasstarterkit.EidasMetadataService.generate(EidasMetadataService.java:438) ~[eidas-starterkit-3.2.1-SNAPSHOT.jar!/:?]
 	at de.governikus.eumw.eidasstarterkit.EidasSaml.createMetaDataService(EidasSaml.java:342) ~[eidas-starterkit-3.2.1-SNAPSHOT.jar!/:?]
 	at de.governikus.eumw.eidasmiddleware.MetadataServiceImpl.getMetadata(MetadataServiceImpl.java:98) ~[classes!/:?]
 	at de.governikus.eumw.eidasmiddleware.controller.Metadata.sendMetadata(Metadata.java:61) ~[classes!/:?]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
 	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
 	at java.base/java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
 	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) ~[spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150) ~[spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:884) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:797) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1081) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:974) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:527) ~[jakarta.servlet-api-6.0.0.jar!/:6.0.0]
 	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:614) ~[jakarta.servlet-api-6.0.0.jar!/:6.0.0]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:205) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) ~[tomcat-embed-websocket-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at de.governikus.eumw.eidasmiddleware.projectconfig.PortFilter.doFilterInternal(PortFilter.java:71) ~[classes!/:?]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) ~[spring-web-6.0.14.jar!/:6.0.14]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.springframework.web.servlet.resource.ResourceUrlEncodingFilter.doFilter(ResourceUrlEncodingFilter.java:66) ~[spring-webmvc-6.0.14.jar!/:6.0.14]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.16.jar!/:?]
 	at org.springframework.security.web.FilterChainProxy.lambda$doFilterInternal$3(FilterChainProxy.java:231) ~[spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:365) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:100) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:179) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:107) [spring-security-web-6.1.5.jar!/:6.1.5]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:93) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) [spring-security-web-6.1.5.jar!/:6.1.5]
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:82) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:69) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:62) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:233) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:191) [spring-security-web-6.1.5.jar!/:6.1.5]
 	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:352) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:268) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [tomcat-embed-core-10.1.16.jar!/:?]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.0.14.jar!/:6.0.14]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [tomcat-embed-core-10.1.16.jar!/:?]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-6.0.14.jar!/:6.0.14]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.0.14.jar!/:6.0.14]
 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) [tomcat-embed-core-10.1.16.jar!/:?]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:735) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:340) [tomcat-embed-core-10.1.16.jar!/:?]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) [tomcat-embed-core-10.1.16.jar!/:?]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:896) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744) [tomcat-embed-core-10.1.16.jar!/:?]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) [tomcat-embed-core-10.1.16.jar!/:?]
 	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-10.1.16.jar!/:?]
 	at java.base/java.lang.Thread.run(Thread.java:840) [?:?]
 Caused by: org.apache.xml.security.signature.XMLSignatureException: Supplied key is not a RSAPrivateKey instance
 	at org.apache.xml.security.algorithms.SignatureAlgorithmSpi.engineInitSign(SignatureAlgorithmSpi.java:217) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.algorithms.implementations.SignatureBaseRSA.engineInitSign(SignatureBaseRSA.java:131) ~[xmlsec-4.0.0.jar!/:4.0.0]
	at org.apache.xml.security.algorithms.implementations.SignatureBaseRSA.engineInitSign(SignatureBaseRSA.java:137) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.algorithms.SignatureAlgorithm.initSign(SignatureAlgorithm.java:274) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.signature.XMLSignature.sign(XMLSignature.java:794) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl.signObject(ApacheSantuarioSignerProviderImpl.java:64) ~[opensaml-xmlsec-impl-5.0.0.jar!/:?]
 	... 99 more
Caused by: java.security.InvalidKeyException: Supplied key is not a RSAPrivateKey instance
 	at org.bouncycastle.jcajce.provider.asymmetric.rsa.PSSSignatureSpi.engineInitSign(Unknown Source) ~[bcprov-jdk18on-1.77.jar!/:1.77.00.0]
 	at java.base/java.security.Signature$Delegate.engineInitSign(Signature.java:1370) ~[?:?]
 	at java.base/java.security.Signature.initSign(Signature.java:635) ~[?:?]
 	at org.apache.xml.security.algorithms.SignatureAlgorithmSpi.engineInitSign(SignatureAlgorithmSpi.java:212) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.algorithms.implementations.SignatureBaseRSA.engineInitSign(SignatureBaseRSA.java:131) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.algorithms.implementations.SignatureBaseRSA.engineInitSign(SignatureBaseRSA.java:137) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.algorithms.SignatureAlgorithm.initSign(SignatureAlgorithm.java:274) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.apache.xml.security.signature.XMLSignature.sign(XMLSignature.java:794) ~[xmlsec-4.0.0.jar!/:4.0.0]
 	at org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl.signObject(ApacheSantuarioSignerProviderImpl.java:64) ~[opensaml-xmlsec-impl-5.0.0.jar!/:?]
 	... 99 more

We suspect this is because of this change introduced in Java 17.0.10: openjdk/jdk17u-dev@9165f77

We verified that that it is working with Java 17.0.8.1, we did not test with 17.0.9.

Make a version for OpenSAML 4

OpenSAML 3.X is end-of-life 31/12 2020, so we should introduce a version for OpenSAML 4.

Since OpenSAML 3 will be used for a while longer, we'll create the opensaml4 branch in which we support OpenSAML 4 (until OpenSAML 3 is retired).

Add support for RSA-PSS to OpenSAML

The eIDAS crypto specifications mandate that RSA-PSS is supported. We should add support for http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1, http://www.w3.org/2007/05/xmldsig-more#sha384-rsa-MGF1 and http://www.w3.org/2007/05/xmldsig-more#sha512-rsa-MGF1.

See
2019_05_21_eIDAS Crypto Requirements_v1.2_Final2.pdf.

eIDAS and ECDH support

Some additions should be made to enhance support for eIDAS usage as well as for generic ECDH support.

One of the issues with ECDH is that default OpenSAML implementation fails unless recipient metadata contains explicit list of key wrap algorithm. Just providing a list of data encryption algorithms is not sufficient. This can be fixed by amending the encryption configuration, but this is a bit tricky.

The following should be done

• Add unit tests for ECDH
• Add generic encryption configuration help for peers with absent key wrap configuration in metadata
• Add encryption configuration profile for eIDAS that complies with the eIDAS algorithm requirements