Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard.

Does anyone use this XML encryption format? Are there any significant deployed systems that use XML encryption? Is it used in practice, or is it just something that exists on paper and is pretty much irrelevant in practice?

(Note that XML encryption is different from sending an unencrypted XML document over SSL. The XML encryption mechanism provides a way to encrypt the contents of the XML document, so you have an encrypted document.)

The standards document is here: http://www.w3.org/TR/xmlenc-core/ You can also find a more recent draft.

share|improve this question
1  
Do you have a link to the XML encryption specification, or any official documents? An RFC or IEEE/IETF document would be ideal. –  Polynomial Oct 14 '12 at 21:50
1  
Do you mean http://www.w3.org/TR/xmlenc-core/ ? I have not seen it used in the wild (contrary to XML-DSig, for signatures), but it is supported by .NET since version 2.0, so chances are that some poor soul somewhere got misguided enough to use it. –  Thomas Pornin Oct 15 '12 at 0:40
    
I added a link to the standards document. Yes, @ThomasPornin, it's exactly that one. Your answer is exactly the sort of information I was curious about. Do you want to post your comment as an answer? –  D.W. Oct 15 '12 at 2:20

2 Answers 2

up vote 5 down vote accepted

Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to).

Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all in-transit though, not for long term storage.

share|improve this answer
2  
ASP.NET configuration files use this at times, too. –  AviD Oct 15 '12 at 11:02
2  
Ah yes, correct! I was just listing an example, but web.config stuff is definitely a good example for long-term storage. –  Steve Oct 15 '12 at 16:38

According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF),

The W3C XML Encryption specification today marks the de-facto standard for data encryption in complex distributed applications. The use of XML as core data syntax, e.g. for major business, e-commerce, financial, healthcare, governmental and military applications, has resulted in broad adoption of XML Encryption to protect confidential data—especially, but not exclusively, in the context of Web Services.

They then go on to explain why the current version of this standard is susceptible to a padding oracle attack, due to the fact that it use CBC mode for encryption. The new draft solves this by using GCM mode, which authenticates the message.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.