Re: [wss] Comments on WSS-X509 draft 06-05 merged.pdf

[NISHIMURA Toshihiro <nishimura.toshi@jp.fujitsu.com>]

Tim,
I see your proposal has two points.

1. <wsse:compartment> element
  I think your requirement is satisfied by using S:role attributes.

  - A message sender encrypts some part of the message using a
    symmetric key.
  - The sender encrypts the symmetric key using Recipient1's
    key-aggreement key and put it in 
    <wsse:Security S:role="Recipient1"> element using
    <xenc:EncryptedKey> element.
  - <ds:KeyInfo> element for Recipient1's key-aggreement key is also
    added in the <wsse:Security S:role="Recipient1">.
  - The sender encrypts the same symmetric key using Recipient2's
    key-aggreement key and put it in 
    <wsse:Security S:role="Recipient2"> element
    and so on.

  I attached the sample.

2. References flow
  Your proposal adds <wsse:Reference> element in <ds:KeyInfo> element
  and achives the following flow.

    ds:KeyInfo    
      Reference -> xenc:EncryptedKey(Compartment) -> message element

  With current spec, the flow will be:

                  xenc:EncryptedKey       -> message element
    ds:KeyInfo <-   ds:KeyInfo

  or
                           ds:Signature   -> (signed) message element
    BinarySecurityToken <-   ds:KeyInfo

  Is it better we also allow <wsse:Reference> element in
  <BinarySecurityToken> element?

    BinarySecurityToken
      Reference         -> ds:Signature   -> (signed) message element

---
Toshi

---
NISHIMURA Toshihiro (FAMILY Given)
nishimura.toshi@jp.fujitsu.com
XML/Web Services Technology Dept.,
STRATEGY AND TECHNOLOGY DIV., FUJITSU LIMITED


At Fri, 04 Jul 2003 15:39:39 -0400,
Tim Moses wrote:
> 
> [1  <text/plain (7bit)>]
> Toshihiro - I agree with many of your observations.
> 
> Please consider the attached proposal.  It includes an example to illustrate
> the following policy:
> 
> "Recipient 1 is permitted access to Element 1, Element 2 and Element 3.
> Recipient 2 is
> permitted access to Element 1 and Element 2 only."
> 
> I feel certain some optimizations will be possible.  But, we have to make
> sure that we provide proper support for policies in which different
> recipients are permitted access to different portions of the message.
> 
> All the best.  Tim.

<snip>

--------------------------------------------------------------------------
--------------------------------------------------------------------------
<S:Envelope>
<S:Header>
<wsse:Security S:role="Recipient1">

  <ds:KeyInfo> !--Reference to Recipient1's key-agreement key
    <ds:X509Data>
      <ds:X509IssuerSerial>
        <ds:X509IssuerName>Issuer of Recipient1's certificate</ds:X509IssuerName>
        <ds:X509SerialNumber>Serial number of Recipient1's certificate</ds:X509SerialNumber>
      </ds:X509IssuerSerial>
    </ds:X509Data>
    <wsse:Reference URI="#a"/>
    <wsse:Reference URI="#c"/>
  </ds:KeyInfo>

  <xenc:EncryptedKey Id="a">
    <xenc:CipherData>
      <xenc:CipherValue>
        Key1 encrypted for Recipient1
      </xenc:CipherValue>
    <xenc:CipherData>
    <xenc:ReferenceList>
      <xenc:DataReference URI="#d"/>
      <xenc:DataReference URI="#e"/>
    </xenc:ReferenceList>
  </xenc:EncryptedKey>

  <xenc:EncryptedKey Id="c">
    <xenc:CipherData>
      <xenc:CipherValue>
        Key2 encrypted for Recipient1
      </xenc:CipherValue>
    <xenc:CipherData>
    <xenc:ReferenceList>
      <xenc:DataReference URI="#f"/>
    </xenc:ReferenceList>
  </xenc:EncryptedKey>

</wsse:Security>

!--

<wsse:Security S:role="Recipient2">

  <ds:KeyInfo> !--Reference to Recipient2's key-agreement key
    <ds:X509Data>
      <ds:X509IssuerSerial>
        <ds:X509IssuerName>Issuer of Recipient2's certificate</ds:X509IssuerName>
        <ds:X509SerialNumber>Serial number of Recipient2's certificate</ds:X509SerialNumber>
      </ds:X509IssuerSerial>
    </ds:X509Data>
    <wsse:Reference URI="#b"/>
  </ds:KeyInfo>

  <xenc:EncryptedKey Id="b">
    <xenc:CipherData>
      <xenc:CipherValue>
        Key1 encrypted for Recipient2
      </xenc:CipherValue>
    <xenc:CipherData>
    <xenc:ReferenceList>
      <xenc:DataReference URI="#d"/>
      <xenc:DataReference URI="#e"/>
    </xenc:ReferenceList>
  </xenc:EncryptedKey>

</wsse:Security>

</S:Header>
<S:Body>
<xenc:EncryptedData Id="d"/>
  <xenc:CipherData>
    <xenc:CipherValue>
      Element1 encrypted with symmetric Key1
    </xenc:CipherValue>
  </xenc:CipherData>
</xenc:EncryptedData>

<xenc:EncryptedData Id="e"/>
  <xenc:CipherData>
    <xenc:CipherValue>
      Element2 encrypted with symmetric Key1
    </xenc:CipherValue>
  </xenc:CipherData>
</xenc:EncryptedData>

<xenc:EncryptedData Id="f">
  <xenc:CipherData>
    <xenc:CipherValue>
      Element3 encrypted with symmetric Key2
    </xenc:CipherValue>
  </xenc:CipherData>
</xenc:EncryptedData>
</S:Body>
</S:Envelope>
--------------------------------------------------------------------------