.NET系统加密到Bouncy Castle Java解密引发错误

Question

这个问题很棘手，但我需要任何帮助。

我在我的端使用system.security.cryptography.XML加密XML SAML Blob。

加密工作正常,但是当它击中另一端的java库时,它们会得到错误：

java.lang.ArrayIndexOutOfBoundsException: too much data for RSA block
        at org.bouncycastle.jce.provider.JCERSACipher.engineDoFinal(Unknown Source)
        at org.bouncycastle.jce.provider.WrapCipherSpi.engineUnwrap(Unknown Source)
        at javax.crypto.Cipher.unwrap(Unknown Source)
        at org.apache.xml.security.encryption.XMLCipher.decryptKey(Unknown Source)
        at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:680)
        at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:611)
        at org.opensaml.xml.encryption.Decrypter.decryptUsingResolvedEncryptedKey(Decrypter.java:761)
        at org.opensaml.xml.encryption.Decrypter.decryptDataToDOM(Decrypter.java:512)
        at org.opensaml.xml.encryption.Decrypter.decryptDataToList(Decrypter.java:439)
        at org.opensaml.xml.encryption.Decrypter.decryptData(Decrypter.java:400)
        at org.opensaml.saml2.encryption.Decrypter.decryptData(Decrypter.java:141)
        at org.opensaml.saml2.encryption.Decrypter.decrypt(Decrypter.java:69)

        public XmlElement EncryptXml(XmlElement assertion, X509Certificate2 cert)
    {
        //cert = new X509Certificate2(@"C:\temp\SEI.cer");
        XmlElement returnElement;
        EncryptedData message = new EncryptedData();
        message.Type = "http://www.w3.org/2001/04/xmlenc#Element";
        message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES128KeyWrapUrl);
        //message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES128KeyWrapUrl);
        EncryptedKey key = new EncryptedKey();
        key.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url);
        key.KeyInfo.AddClause(new KeyInfoX509Data(cert));

        var rKey = new RijndaelManaged();
        rKey.BlockSize = 128;
        rKey.KeySize = 128;
        rKey.Padding = PaddingMode.PKCS7;
        rKey.Mode = CipherMode.CBC;

        key.CipherData.CipherValue = EncryptedXml.EncryptKey(rKey.Key, (RSA)cert.PublicKey.Key, false);
        KeyInfoEncryptedKey keyInfo = new KeyInfoEncryptedKey(key);
        message.KeyInfo.AddClause(keyInfo);

        message.CipherData.CipherValue = new EncryptedXml().EncryptData(assertion, rKey, false);
        returnElement = message.GetXml();

        Logger("Cert Size: " + System.Text.ASCIIEncoding.Unicode.GetByteCount(cert.ToString()));

        GetBytesKeyAndData(rKey, assertion.InnerText);


        return returnElement;
    }

Answer 1

我为RSA密钥的AES加密更改了keywrapurl的大小。

我仍然不太理解opensaml java库的加密是如何工作的，在破解它之后，我对用java设置一个简单的测试环境所需要的时间感到惊讶。

这个故事的寓意是：不要对大量数据使用非对称加密。

public XmlElement EncryptXml(XmlElement assertion, X509Certificate2 cert)
    {
        //cert = new X509Certificate2(@"C:\temp\SEI.cer");
        XmlElement returnElement;
        EncryptedData message = new EncryptedData();
        message.Type = "http://www.w3.org/2001/04/xmlenc#Element";
        message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES256KeyWrapUrl);
        //message.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncAES128KeyWrapUrl);
        EncryptedKey key = new EncryptedKey();
        key.EncryptionMethod = new EncryptionMethod(EncryptedXml.XmlEncRSA15Url);
        key.KeyInfo.AddClause(new KeyInfoX509Data(cert));

        var rKey = new RijndaelManaged();
        rKey.BlockSize = 128;
        rKey.KeySize = 128;
        rKey.Padding = PaddingMode.PKCS7;
        rKey.Mode = CipherMode.CBC;

        key.CipherData.CipherValue = EncryptedXml.EncryptKey(rKey.Key, (RSA)cert.PublicKey.Key, false);
        KeyInfoEncryptedKey keyInfo = new KeyInfoEncryptedKey(key);
        message.KeyInfo.AddClause(keyInfo);

        message.CipherData.CipherValue = new EncryptedXml().EncryptData(assertion, rKey, false);
        returnElement = message.GetXml();

        Logger("Cert Size: " + System.Text.ASCIIEncoding.Unicode.GetByteCount(cert.ToString()));

        GetBytesKeyAndData(rKey, assertion.InnerText);


        return returnElement;
    }