Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps

  1. sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as Payload-signed.xml.
  2. pack the signed XML Payload-signed.xml file into a zip file Payload.zip
  3. generate a single-usage 32 bytes key for AES-256
  4. encrypt the Zip archive Payload.zip with AES-256 as Payload
  5. encrypt the AES with RSA public key for exchange as Key
  6. bundle encrypted AES key Key and encrypted zip file Payload in a Zip archive

How to implement this process with existing open source tools (with preference for Linux platform) ?

Remark: this project demonstrates how to do it with .Net

  • This is a programming question more than an InfoSec question. You have the steps, you just need the commands/program to do it.
    – schroeder
    Commented Jun 30, 2015 at 20:31
  • From my point of view, this post matches the following topics "security tools" and "using cryptography". It does not sound relevant for "SuperUser", so probably you should migrate it to "StackOverflow" (as a by default choice). Regards Commented Jul 1, 2015 at 6:54

1 Answer 1


Here is the process I have designed with available Linux tools. Care to all file names (case sensitive) and replace MyOrgGIIN with your organisation's GIIN identifier.

  1. There is high risk that quotation marks and comas are present in your FATCA XML file. Expunge these characters from the XML file to avoid failure at submission (and some others like hash and double dash, read this PDF for details).

  2. Include your ftc:FATCA_OECD XML structure into an enveloping signature template specifying expected cipher and hash methods (Payload.xml):

<?xml version="1.0" encoding="utf-8"?>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <Reference URI="#FATCA">
        <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
  <Object Id="FATCA">
    <ftc:FATCA_OECD xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
      xmlns="urn:oecd:ties:fatca:v1" xmlns:ftc="urn:oecd:ties:fatca:v1" 
      xmlns:sfa="urn:oecd:ties:stffatcatypes:v1" version="1.1">

      [... your data ...]

  1. Generate XML signature in prepared template with xmlsec1, it will fill empty nodes:

xmlsec1 --sign --output MyOrgGIIN_Payload.xml --pkcs12 myorg_ssl_certificate.p12 --pwd pkcs12password Playload.xml

  1. Compress signed XML payload as zip archive

zip MyOrgGIIN_Payload.zip MyOrgGIIN_Payload.xml

  1. Generate a single usage 32 bytes key

dd if=/dev/random of=mySingleUsageAesKey bs=8 count=4

  1. Display the 32 bytes as hexadecimal sequence (64 characters)

xxd -c 32 -p mySingleUsageAesKey

  1. Encrypt your Payload.zip file with AES-256 passing your hexadecimal key as -K option

openssl aes-256-ecb -nosalt -K HexaSequenceForMySingleUsageAesKey -in MyOrgGIIN_Payload.zip -out MyOrgGIIN_Payload

  1. Encrypt the AES key with IRS RSA public key

openssl rsautl -encrypt -certin -inkey IRSpublickey.cer -in mySingleUsageAesKey -out 000000.00000.TA.840_Key

  1. Generate a timestamp with date "+%Y%m%d%H%M%S%2NZ"

  2. Create metadata file using this timestamp from IDES site as MyOrgGIIN_Metadata.xml

  3. Pack your metadata, encrypted payload and encrypted AES key in transmission data archive

zip TIMESTAMP_MyOrgGIIN.zip MyOrgGIIN_Metadata.xml MyOrgGIIN_Payload 000000.00000.TA.840_Key

Now submit and react to errors notification.

Not the answer you're looking for? Browse other questions tagged .