How to consume tokens from Infocard
So - if you’ve been wondering how my RP works...here’s an overview. I’m not going to cover declaring Policy or anything, as Mike Jones’ paper seems to have covered it in pretty good detail. I’m assuming here you can get InfoCard to invoke and POST a token.
To get started, you need to get your hands on the XML Token. This should be pretty simple, as your web framework will generally hand back parameters already URL decoded.
Once you’ve got the token, you’ll need to decrypt the token. The token is transmitted as encrypted XML, and will look something like this:
<enc:EncryptedData xmlns:enc="http://www.w3.org/2001/04/xmlenc#"
Type="http://www.w3.org/2001/04/xmlenc#Element">
<enc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" />
<dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<enc:EncryptedKey>
<enc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
</enc:EncryptionMethod>
<dsig:KeyInfo>
<wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">zHXxYr8jTDe/UhznC81ixsQXSpI=</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</dsig:KeyInfo>
<enc:CipherData>
<enc:CipherValue>hgBNzEXXnoLNu6DPhXJanirEPOK/ey53RKISJrwvRhQazPBgqcnZPaxNVqZf6TOR1VbryCU6fbGw
jIuuXzTb5Z+0PsRPM4N8CLSBxYxN1BFCNnhW67qJ4zrw72OTIkkTLWvPDpJpAak6X6RGFteaf3zD
uVYU4Ta0sDmMD6lxgjs=</enc:CipherValue>
</enc:CipherData>
</enc:EncryptedKey>
</dsig:KeyInfo>
<enc:CipherData>
<enc:CipherValue>qCiqGzgr9JKl8hQXKBkZ7d+CIDmppKGTQgTYCjgT1/jR/0A4uj7gxLtERM09OACzC3oXGHn7o/9qk8J2seWp2gZdQSWcnEavbgGOYDARGi7Vu5jsBrav5m1d4HrpKD2H1uCgB8xNR6eHKoPrsCGN9x9chWph244dD3HlXMXj90OSFSt+/y1oy6DWQV8EC94C4mbUH9udNc2cp90n2MCdHIF+jmjGrDQHVL4AHIYEFbH8b5rIHrW/oFlztcVhon1vOTQ4u3AO6jPINvcZK92greuWMdoyc2Lhx2/G4xNjhRpGdyfFOSHStOCv1xA0mZSvnn9bTMT3khMjPKL5KWdwTduKghMJsoZLFC6M2b2HHM9KdihvF2qPMXMsk8ZOf4dmL76bTzOsfC0yTtasY6L4lLnq9jdOE9NVnxk3KiUtE3ckrwdsKTTP/7VqrXcfdL0NAT04KF30D3Gb3sjm5kebO28fFjC61bMGOd+9KiQUxZ3WO/Tsjiw2FauPJ2lELLQGiUzsvxQ168KBvqvvyBNrDdEYg/XEGnnqBvslV5zGYceV5ptPP8oNJe0ehuzjuN4EPe2RNuOsdXT3I9xp8vetEIFZ0oUw8Vvvocl7AbY8EwHGaHEN37PAzwISLjmm3PZxj5KqLWCo29nvcWWYT7zg154TrgjuU8SeKA3JtYif0Mjoh/OdBuKRjlcAX+a3NYeqBbag80pau7Yd+c6Vm3oQvqJEiA6ofay3kZL1xyhYFKo9CUxd5TfVUFFqSNCx6uUr6bVyYsU4C2TxpF5bl3mVCFqNtlG9QI1nr89zQgSfvbiTE31snHq++RU7xY2yZp8wiTOS4T560oqFKWf5PR9QjjSZh68tKzIM7aZeI3pV3v2wDVoIjkY8SL408xBfIeAW8K5Ea9/b2l7FSnMJ8Hr85EsfREV++odQWYN2iFlFUvMqPYGmCNVoV1/IE19oVdm1ekJK/JQbd3D4VLyiXezCL4a1a5wpOXlznpuYBDVo3IeQI38pl2NYSBWLqYxbDCmriEceKFSDKOr+ByRQgcOmtvE95EW3j1xudIHrzeOorY1RSGuQtXDaey7Ic5cQS3IpjAHM8cPjDMP/T3fXaoY887oruSD6xQtAcvHN21D+nI4V/d7Ze+JRBsuGIcEmkvmF0sdeVQt9GADEbTo4btnrls8JaSfnTePIXZ1V164oUzr+wRU66zV7AL0uk/2poZPps2DtGV+S/u7Mm8bZihs7I4WqqWu5b7wFQ2TKReFD92XJu8gmxVdoQIivFKGNrBPt9Q20FAEnW97LbKhotL/Sy0tD8cVvgmEyK2CYsrqLYAtOv647hA3tcGYKWLoZ6Vmxdd/BVl7UxNiTfnImX/83MVuV0SetKnRRnROnJoGDHFGXWnPKIU9WHezA89xKvwTen9dg1g2YgsM7H6K46yQzREx0evvt0Ax2j6tmRulGuhvckGTl0szZVBK0DSK+fHgJqf4jaN/RooFG4IkdKhaxHuILlA7137JahdhoWPlv2amaCKB8S+FyFPX/C59zXY/fQZw+3g5joMdbWt/M6NL1zgJlPzrEqUTo/t94m1j8qllh0k2TuPtdtLdkJQHxYg/e0NZgLgH/czbUPdG3dR+dAqxFaCcyfcy040vLCqGw9cpcz5iyGGh953ALFoCRGDRQuaghb1zO3eqI/ZxC0C9hv6M/nOF7pyH4mqUl3B+ctvk0yxQwhcoAS5CXi3C0LmryhMQevYfyVbJMMOHlxBmaYq1JAPwUTcEGGCQhfgo6uVgpoe2KAgGhV43GCRxk2tjuXFsYR1byy08bCFfTqXIYCLKRFvoElbbk6toubndS9XuiH8C3fVX21A0Ck6zZF9GoZzYkczuLYQZF+3FZw41KOV7/S7ASVIgAVQPeR5aLggJ2eeFdTFNYAJhZUq6exWfns3o7S2UAgF7qNGj/TIJGLZmZVElsAqWLpQGZskoeFCceNibEeWp+4YqIkz8r3MGedWYfuOfSHF8W/LoYR6Pgwh9Bt1Acx1LG2aALtmh/LgzjCGatxy3QwOXj0k+ghzFiQOzXJuLOYyKXVWnMI9kxJGZA5dLASD4np6/Yy4LMFZdJ6Q7o/5E68Bv6VXLMfhsdIXJwxVvHNgomIez/nwNc52edUkPT8AP2mRpmE9pDNOw4o/KZAhwn4e4lEfkIhZmN/Xn+SBRCEId3CrJM749WJpvd30T9Is5PcCZ3yQ+QIPBmizaOSIfkT2XshTZ99FNxzQlx7mdz6wv8bGIO+Ox9rcvP4zbN+6QWta9lvRdtW+0mA6ms8M19vCecc4EmlxLO/hhYj5gGZYGCswVgHmKQabzOeOzXbn1xF+kOm4j1bWz1/yBwvduCK2Qtv8RYYBKfhKcx7zR9fiRkzAeqqOrEQ/AxXM0cXVmTWb01TKs+vrPkEKzT+DulwAO9RVNFs+7sOAzVC50YCCuPjMLu2D52NCw4IMAed5eSmT5wZ74XHAg+Lzbz6WspTfeabDthchP99IeRHgb1ybyCxUXfeBMocG6HAEhCgDg/oGGe/99aLvE7jGbgbZrbdALJOd32/oGWtMeecft5lomAI/vGjAcrcOpIgUKKE+ANFShGTsk3LJ5qw/juL44a5kOf1rZUMZHiAUKQzW6iOsYDRiYnYzC1HAtpHjGO++i90FYsHLyoxrq4aRNdgptIoa92D+5qPQLVCSPAX4/lEkQ6YECt9jmDhFWPGfp7Hql959h35vZCHEwvZi6i8ATQIgiVaXX9TNdZNUaFQaDy6g+6Hqxb9qsTDQfJ9JkeEkPrgxjFMlIC4iAkBQHajBtPVq51V4r6klbqnKNdTshJnVwwQ688bGg+ccIojmKQmyNlV2Ws/3VGyVfQd7JAQv0qcThGltEig0RVwPYeS+PMxuCup2A1hws+qEGdUUSkvF/xs48+SW91xjoqxEDDEyVobx/Zrnnn53PDM6TGDqMgMyZ5WYVW3jvzqY6watMdTwHXUHzS9OvjxxN3qdQfdp7EDF6hkCitWyG8NWsDR6Aam/V2dxa3E8JjjSc1Ja4PUB7g8jiHonzyVvEvKQ5NZ325L4pPBcEUdbtpyfVsb5AsofEkvibc3AwRyBxxtdunhnNB04CZAFQlcYJygAdaZ7hafuqaey+vRFJl3DRNDX71mzsPyexBzxug0uBeX4HlmpQqi6HSemRLeLAx/7DBJ1EFbAqu0zv2uas8rknok19xU0+wHOeHcWGNUPfjJfCc1RdkJ425JT+1VVXgpThJk5l0OjK737ZEw0/ITUMUv0KbhwJX1cGLacCfEWPIDeubDzkHpNpYqzBj1WPV1Nc2YjX7jFvhoomYeE/ihJA08JsXIAXlX/GkDRJL164x1DMy8pUtzzrDPhIUlT/8XJCRSUa2lQ4lms4WrMxh3aFKHBTLQS6RAK2QlBYdWMSCNz3oytVqLxqf/KkGrhjqJajylYxFS3ktia3j0k5PpH+gpNEuiQL3F2zSfT9vn8nOLQDhfyF7kVuW1AN/paxknCYL7TCJuqK9DNAQyW7hQ7Ij/3NRvIZ+ztFYWj2wziGqjvNXzRhUNi/z+qAeBPNpwzGTRYQoGSoucjorpiEDj2nrKAnxIwwC+i4CWr1A1fLY6e2obpxN5J7D7lcSuXvvF/GqEXEkqZJc8V5zj9ct3ISqG/hEJ9kdnAjeqFkK35/ZlKlfVFbcomBYFWucUC8DPA6a54RIOJK37GNLNahhRh8tgKU2KSknUpejqdF9Jlz5K4ndUrPTqmRzv8ROiMU6WNKtUsEFGOMtdQpb1t13iX/gadVdBbmr4opaIpPhEctuaPx6S0a+e7jJarvQRl6DhTysjnlw56sK3QImHGuJ2726Lh8+6UymbtdizBIJ8fsj5EI5a0FpaBHe1EmJ05p3SmVnW8Gieccevbg4Tp9LRLQEobBT+AzlLbEuIBWxj8tVKegbXlt1ndefuxbzfmgwE3vno0A31tbKEagO/j6zzcSLmdHjG/Csti6QHM8BIX/Bld/W4m9rk0FBvyoiM91pxZSoU0LngVJC+EIKL/OcMzehyEwdbR6f6E8LjDQBBmdFC9VLcpr2ao0YeMGPRdD0ldPAj1IU+l0d473qc6f1ZzQ0lw7JHkwOoHebqQQgZtg+gyy1ejKRIVi55wfshHssKBujAvdV3MM9yKgbXXunO0gSEX/clk74lx3qQR9WNOsbX5B2Ex0UmEXRFTFl5n86annC9QRWtj/IpTNjbktXzxrxAbg0ePp3i59z994+hjp0Oq83rAnT06R1GYI3I9G+KYjtDz0cPZ4c0P8gsETxmW4AjSsGbxGGwxSXoUsut86ENWtpsCIYwsc/BX3UNe4/PjLuzC9InJb93e8C8fB/rdiUpBOco9U0e1AS1fAMBhwhJOOnMZlTZa0R1mJyCarWtvLcMTrO9uWXS/s9NvdGLHRgrW1yMyNmXLEZsDoejl0IsiOx2lzwoyNd+m5G0LOGdHa9uFvlPwYnZ579h3fvWSR5yyV9YZwBD8Zvk3kGPcJd8ybz3Dw21lpHXEsWEReS3kkq+doQE60sv4gXhLGFHZAOClbFKNLcXuW1UX2QE+sjPjn3NsucEE4FQDsMBEQbdZnlFR6rsKAM+ePGJlBn7I9DDMZQpOIZhVkXF6y2q1n9qGvN/HTb3xplWjR/RXFKKqiaShktHdBnPIOmJnXRIvE8EJpq0tMd088QHmbGENDyq0HDgv1nmKfQq+xoyuEOy88gayUdxo8cvoJ6gcrSYLZVr0x3njwSZVgRrmhWsmV29uyEbOYIrIs8o0QlHWZ8m7jO04zbPY34q4otbNq+Qq3jrYwPc/+Opx940ehRKz/+/AePjjSMmbokHDV+hv40HWn4ACWluF8AzQF81H1HNKgIbuK6HZq8j0TEHbBwWDByPuMf6GkwV9gBKuuiNHy9VQiTssuz4dx6Qs0eqEDTJ0bsd30Z+jk9DtxC6f19YJhEv9Ait/SahUt0vjS+8lxuIWUWnz4fy7NTqRWhukVwe97rrZxyosZSsQjPkzSFOA9FAhOaSFVsP+dZeJv4tqmsWMtZ4mmtSQaz62VFGd6NuSwtk2giaZIzW+EcK6qRYjFOiGmZtZpTClqp3h4VpioTGZxLu8vEx91vE0Ew1H8W9YhNW2bEFajK1Vhimx6HkFn8Yy/WpFh28S4peDWIu25DiotDhSJE0iiqz228nk4xHK4kmzWqwVsrhoIo1m+SjNajFfdMVXWZHD3emsS2ZEGa96c/BuxyreGryvQhqz9TQG2Tqw/XXrK+jSYHe734jQ4jTAAfhu0MxBFeiHJJo5robDePuKid/Vh1hvb0uVKKmdc7wNqGXHjP3qM/uyrJJ4tJSBknd0YKc0kTTxeDmJY1pj8yX2gk5SuqhhEBssaJp2bS9lYucYiVM4IrZ4+osVdF/iIxt/5sIQPmPmiaKlkV5Guq7hjOldchCNsanpP2MluTuoptmjXgwfR3lsDokcrva9mKvaaIzofziGFffsYLlBv9t0YS5ZUtW064aa4Z9qGLTXEzmZjvwEU51sSLc371m2U6LLxoT1vSJPtV0idtzR6Q9ezzHeSuaRctGbbVOUyCfd1CL60PlNmTlrUSTavfldGxuGdT/7+WkozgfI+AUih9G1uA1999dGWOy/LBg+Znvb53O5sgrENYiV5OIfVGG7k008I34mkIv6NixpOz8/qixcvFYfl18LvAQSEYFuNaKZfp3WvrJRpxPIZiYx0240G/EjdfKmZLrrPF/zijyW1IjQhwo+xg3n/0BL5MbCFoXztncWX8tVfOW/HEH+m3oAj3eCz83K00vDNqGpGlfxF4f3KGYR7oGglhcMAAnYd0xhggXlMBpDVDv5pLHZCx+CWfNmX7ZCBsVeDmTZgUmq76L5cn4yrhFjm4PypSsO4H1n/lgymZhx1ydb4ZD2tYOzoxEYyJfkEP4h07fJBLi/hp98PCL7Da4mIq81u+7y4jNs3WHO//nmbEBg3LisgmZHrBVI0OUphmNpM+eU5FM1F8eo3za5I3fymPPjOymrsO7fEvdhSLqBbwTqzNAhzw8/vx4I7e9rG7emnvU/3cQAcKd3J5RCChjf0ofWgzmU5bGKYyNHU1IZvhC+Z2kk7TINQyYas3E9uYrZjGS9pF8ppkdc8UdLJaapnPN1h7+DybO2QYQ2hTzU88+sUASUtv/LWFFq0isKjfqDW9XYj4FaIDuGZ6A1Fswy6QYHaeaRi8GCdtT4C8LyCmVkadWNlbcloZPosI8q/qTG9NigEA1p7j7ahAzeZhBUPuCX7vhvFoGg6Ie9wE754X57BvYKqcFbO2WPoDfEir0ibQpS+2uAu7tXdiWEqTId8Fv7JnSs9thx+M1ZYJHe1n1xDdX2FngsWTd2CLvYvHZGl52fmjl/UP7P0dIABY6enZKZ/XTNwKEGc98fijrvMW9CaH6D1N5vCPddD/VBlImkiCaiD7jGNyAtj5xwgGj0OnBHf2mhxHpq650L5qb5NkojFB9Bb07c2UkUxIATy0dZkxtZyK5uIB6IIs1b1bHiaKJHwp4qTw7k3xxXuhSUPdRSncSL19XVUNwnWhQtS4r+jvoM2gsglXDB8yjhXWwc6JvLTp0VKq4XsAM6BV4DodPC4N/GgGYghhxy6uO7ViRU+R0z/H4o/VMifUvOs4anMY1SSe</enc:CipherValue>
</enc:CipherData>
</enc:EncryptedData>
Basically what you have here is an ephemeral symmetric encryption key, which has itself been encrypted with the Public Key of the SSL Cert for the website InfoCard is interacting with. As you can see from the metadata provided in the KeyInfo fragment, the key is encrypted using RSA with OAEP encoding and SHA1, using the certificate identified in the SecurityTokenReference with the provided fingerprint (the fingerprint is a SHA1 hash of the cert bytes)
Your first job is to decrypt that encryption key. Step one - remove the Base64 encoding. Step 2 - you need to write a function which takes the private key for the cert referenced by the fingerprint, along with the data as input, and decrypts in this manner RSA-OAEP
Once you’ve successfully decrypted the key ( it should be 256 bits), you can use it to decrypt the token. As you can see in the XML, you need to use AES with a ChainedBlockCipher. Decrypt the token (Don’t forget to strip the initialization vectors...thanks Gary ), and you should see something similar to the following:
<saml:Assertion MajorVersion="1" MinorVersion="1"
AssertionID="uuid:d2de97e7-96ac-4bb3-a373-4fc11c914519"
Issuer="http://schemas.microsoft.com/ws/2005/05/identity/issuer/self"
IssueInstant="2006-03-29T20:52:45.312Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
<saml:Conditions NotBefore="2006-03-29T20:52:45.312Z" NotOnOrAfter="2006-03-29T21:52:45.312Z" />
<saml:AttributeStatement>
<saml:Subject>
<saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:holder-of-key</saml:ConfirmationMethod>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#">
<e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
</e:EncryptionMethod>
<KeyInfo>
<o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">BCDy8bwQIxTqcoTObIhcvR2KOLw=</o:KeyIdentifier>
</o:SecurityTokenReference>
</KeyInfo>
<e:CipherData>
<e:CipherValue>XjkCVuQZ19sYbSnEeKYQ7wD/+bKvGL6kkS2yuVjQX4y3N7U86zRJ66njNPdFNdh8k/x+5CNF1rpjq/Be75a1skO9ePjLgik/UA1DlDo9jaFoYvRlEj0BN/TPJaMZ24kcmcG+QeU89rdg0S4+bqxytHyh14m6IaIaX4aj88RRVq4=</e:CipherValue>
</e:CipherData>
</e:EncryptedKey>
</KeyInfo>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Attribute AttributeName="GivenName" AttributeNamespace="http://schemas.microsoft.com/ws/2005/05/identity/claims">
<saml:AttributeValue>Mister</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="Surname" AttributeNamespace="http://schemas.microsoft.com/ws/2005/05/identity/claims">
<saml:AttributeValue>Milo</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute AttributeName="EmailAddress" AttributeNamespace="http://schemas.microsoft.com/ws/2005/05/identity/claims">
<saml:AttributeValue>milo@xmldap.org</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#uuid:d2de97e7-96ac-4bb3-a373-4fc11c914519">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>leav91ZV/KJpwumP/j+4XtlEvJg=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>gEVmREMwNiE67hMdOf7uuC4jnhG4f9y3WYL2pL6d9F3Nblf3qddMe6K+d/b6ucePKS3Q9XXBmBu2tWtmZlwTzldVjx8IYZb5u5jcQByAp2GrTJb/XxHA/3BkE073zdFRlmHje467kVd4Mcg6X2qNsV1N+euZqCUfmrXyf3cs5n4u6A9A1CTuQhCOGhE7jjDUGPmyChJa2YfHqpiVPEXgqN+RYOTLUFbA2kKj1Jyi8+FJD7vHP/5/kblge82waNFOOaA6d7lXDhr4lBDDhr5vKoNWy91bDMStn+nKN7Nzj7zPjxjynp7CisSewyWxAjcD9XDl/I9Va2UVDmPr4JC4bw==</SignatureValue>
<KeyInfo>
<KeyValue>
<RSAKeyValue>
<Modulus>rCOb7lDap18tsTurz6j/fSYnO+ck5or10hn9tZhCDwXfJip2lqjIFcj3fYv1cyP96dl4++x8QGXSB5WAu3NNtjZkVxTDO4sOk+IpkLOlE5vM6ClMSV46tx9fo6tbQ9EhJTy7vXAbCH6hQnowxdmUEVKJudCtlMeHSotix98T5zJXYMjeLvmDPmSK8pG/t+kBmRjsgSZGqjD4VFlnDBpYOZ4R+nH2ESudyvZUwAkgPAEtGuBcc+nXVUEbs+O1xOkzcTRCm9FCoww1oNSi2maRGontD14Cbyy3DuNRxqPSxEc8rN7KBoq5w2y+Q5YTVYBB+qn2rXbO0aQlYHXIZOATpw==</Modulus>
<Exponent>AQAB</Exponent>
</RSAKeyValue>
</KeyValue>
</KeyInfo>
</Signature>
</saml:Assertion>
The next step would be to quickly check the validity period on this Assertion to make sure it’s still fresh. You might also want to check the AssertionID against a table of previously seen assertions to prevent replay...depends on your level of paranoia.
On to signature validation...you should follow the steps outlined in XML-DSIG, but to paraphrase, check the digest of the canonicalized assetion against the digest in the SignedInfo block, and then valhttp://www.blogger.com/img/gl.link.gifidate the signature of the canonicalized SignedInfo using a PublicKey constructed from the provided KeyInfo.
Now, what’s bugging me is the use for the Symmetric Proof key provided in the Subject of the Assertion. Super Pat and I discussed this for awhile, and since it’s not used immediately in this protocol exchange, our best guess is that it’s used in subsequent interactions with the service, although I must admit the InfoCard docs are a little fuzzy on this subject. If anyone can fill me in, I’d appreciate it!
Finally, if your signature validation worked, extract the claims, enforce any policy you’d like, create a session, set a cookie, etc...
good luck!
21 comments:
Have you tried asking Kim?
My only thought... it would be a bit odd to use a symmetric key for 'proofs' (e.g. proof of origin, proof of integrity &c) when you have a PKI pair available.
So as you say, maybe this is for later use as a data key... but again, why do that if you trust the SSL session you're using?
Hey Robin...
I agree, it's a bit odd. That being said, the web browser binding (for lack of a better term) of infocard was defined after the web service version. In the full version, the RP declares in policy what key type it would like (symmeteric being the default) and there are really 3 parties involved. It might also be a residual from that...
All good questions though - at the moment I'm speculating. Hopefully Kim will comment...?
Gee, I would say it's a bit odd to go through all the public key rigamarole to establish proof of origin (authenticity) and proof of integrity if you have a shared secret (symmetric key) available that will do the both much easier.
One of the main purposes of the SSL handshake is to establish such a shared secret that can be used for other messages in the session.
I don't know if that helps or not.
I tried to decrypt (with Java) the symmKey using the server private key and the RSA algorithm.
But i'm still having a 128 bytes resulting key.
Can't go far with this.
Some tips plz.
regards
With something like this, it's pretty hard to tell without seeing your code...
You could read my source, available at xmldap.org, or post yours and I'll take a look.
hi,Im new comer of CardSpace.
I have a question.
How can I retrive the key of the certificate?Is that the www.fabrikam.com.pfx one?If so, how can I get it using Java?
Private keys are relative to the certificate being used - you can do this in Java by accessing the keystore being used. You might want to check out a quick PKI primer.
The fabrikum cert is simply something from microsoft demo code
Hi Cmort, Im again..
I am trying to implement a Java program that can be able to decrypt the xml file sent by the STS server.
Now Im stuck in finding the public key to decrypt the certificate of the website (I use the OpenSSL to create a certificate myself). Is this a must to have the pulic key from the CA to get the pulic key in the certificate, since when I try to read the certificate, it returns the encoded information that I can not decrypt...If so, where can I get the public key I want or is there any other way to decrypt the xml file?..
Thanks alot!
Alex
Hey - I've got to say that I don't quite understand your question. Can you rephrase please?
thanks
Ok, Im sorry since my English is not very good.
My question is:
I want to decrypt the information in the xml file, that is sent from STS server.I notice that the key to decrypt data is also encrypted and we must use the thumbprint to search for the certificate.
Then, when we have the certificate, will we use the public key of the certificate to decrypte the xml's key? If so, how to get the public key there, since everything is encrypted and we dont have the CA's private key..:)
I hope this would be clearer..:)
Thanks for restating
The xml payload should arrive encrypted using the SSL cert of the Relying Party. You should have access to the private key which can be used for decryption
Feel free to read through the xmldap code for a description
Thank Cmort..Yes, now I have the encrypted token,I can get the public key and private key from the certificate. When I decrypt the key (in xml file), I get the key with 256 bytes..I also notice that for the AES 256, it requires the key of 32 bytes.How can I use the 256-byte key to decrypt the data using AES? Or only part of the 256 bytes is used to decrypt?
The key you should get back is 256 bits. 256 bits = 32 bytes. Hope that is clear...
The key's size is 32 bytes?
You mean the cipher value of the key after decryption ?
Yes - key size. Basically you're decrypting a 256bit AES key.
No - not the cipher value but rather the clear text value. Basically you should get back 256 bits which you'll use for the key in the AES decrypt
Hi, I have a question..
How can I use a Java program to retrieve the private key from LocalMachine (the ..\RSA\MachineKeys store)
I can use the findprivatekey.exe to get the file..But, for the Java program, how to get it?
:)
Sorry - no clue....I work on a Mac.
The xmldap code simply uses Java Keystores. I'd do some googling.
These comments have been invaluable to me as is this whole site. I thank you for your comment.
Glad you've enjoyed!
I have a signed SAML token that I am trying to verify and this very much similar to the SAML:Assertion that you posted. I see that URI attr in ds:Reference element is the value of AssertionID. I want to know if it is a standard way to have the URI attr of ds:Reference same as AssertionID? Any document (like oasis etc) to suffice that?
I'd check out section 5 of SAML 1.1 core
Post a Comment