@authenio/xml-encryption

To help you get started, we've collected the most common ways that @authenio/xml-encryption is being used within popular public projects.

tngan / samlify / src / libsaml.ts View on Github

return new Promise<[string, any]>((resolve, reject) => {
        // Implement decryption first then check the signature
        if (!entireXML) {
          return reject(new Error('ERR_UNDEFINED_ASSERTION'));
        }
        // Perform encryption depends on the setting of where the message is sent, default is false
        const hereSetting = here.entitySetting;
        const xml = new dom().parseFromString(entireXML);
        const encryptedAssertions = select("/*[contains(local-name(), 'Response')]/*[local-name(.)='EncryptedAssertion']", xml) as Node[];
        if (!Array.isArray(encryptedAssertions)) {
          throw new Error('ERR_UNDEFINED_ENCRYPTED_ASSERTION');
        }
        if (encryptedAssertions.length !== 1) {
          throw new Error('ERR_MULTIPLE_ASSERTION');
        }
        return xmlenc.decrypt(encryptedAssertions[0].toString(), {
          key: utility.readPrivateKey(hereSetting.encPrivateKey, hereSetting.encPrivateKeyPass),
        }, (err, res) => {
          if (err) {
            console.error(err);
            return reject(new Error('ERR_EXCEPTION_OF_ASSERTION_DECRYPTION'));
          }
          if (!res) {
            return reject(new Error('ERR_UNDEFINED_ENCRYPTED_ASSERTION'));
          }
          const assertionNode = new dom().parseFromString(res);
          xml.replaceChild(assertionNode, encryptedAssertions[0]);
          return resolve([xml.toString(), res]);
        });
      });
    },

View more ways to use @authenio/xml-encryption

W3C XML Encryption implementation for node.js (https://www.w3.org/TR/xmlenc-core/)

Supports node >= 12

Usage

npm install xml-encryption

encrypt

var xmlenc = require('xml-encryption');

var options = {
  rsa_pub: fs.readFileSync(__dirname + '/your_rsa.pub'),
  pem: fs.readFileSync(__dirname + '/your_public_cert.pem'),
  encryptionAlgorithm: 'https://www.w3.org/2001/04/xmlenc#aes256-cbc',
  keyEncryptionAlgorithm: 'https://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
  disallowEncryptionWithInsecureAlgorithm: true,
  warnInsecureAlgorithm: true
};

xmlenc.encrypt('content to encrypt', options, function(err, result) {
    console.log(result);
}

Result:

  
    
      
        
          
        
        
          MIIEDzCCAveg... base64 cert... q3uaLvlAUo=
        
        
          sGH0hhzkjmLWYYY0gyQMampDM... encrypted symmetric key ...gewHMbtZafk1MHh9A==
        
      
    
    
        V3Vb1vDl055Lp92zvK..... encrypted content.... kNzP6xTu7/L9EMAeU
    

decrypt

var options = {
    key: fs.readFileSync(__dirname + '/your_private_key.key'),
    disallowDecryptionWithInsecureAlgorithm: true,
    warnInsecureAlgorithm: true
};

xmlenc.decrypt('', options, function(err, result) {
    console.log(result);
}

// result

decrypted content

Supported algorithms

Currently the library supports:

• EncryptedKey to transport symmetric key using:

  • https://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
  • https://www.w3.org/2001/04/xmlenc#rsa-1_5 (Insecure Algorithm)

• EncryptedData using:

  • https://www.w3.org/2001/04/xmlenc#aes128-cbc
  • https://www.w3.org/2001/04/xmlenc#aes256-cbc
  • https://www.w3.org/2009/xmlenc11#aes128-gcm
  • https://www.w3.org/2009/xmlenc11#aes256-gcm
  • https://www.w3.org/2001/04/xmlenc#tripledes-cbc (Insecure Algorithm)

Insecure Algorithms can be disabled via disallowEncryptionWithInsecureAlgorithm/disallowDecryptionWithInsecureAlgorithm flags when encrypting/decrypting. This flag is off by default in 0.x versions.

A warning will be piped to stderr using console.warn() by default when the aforementioned algorithms are used. This can be disabled via the warnInsecureAlgorithm flag.

Issue Reporting

If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Author

Auth0

License

This project is licensed under the MIT license. See the LICENSE file for more info.

Releases

Release notes may be found under github release page: https://github.com/auth0/node-xml-encryption/releases