XML Signature 1.1 Interop Test Report W3C Working Group Note 13 November 2012 This version: http://www.w3.org/TR/2012/NOTE-xmldsig-core1-interop-20121113/ Latest published version: http://www.w3.org/TR/xmldsig-core1-interop/ Latest editor's draft: http://www.w3.org/2008/xmlsec/Drafts/xmldsig-core1-interop/ Previous version: Editors: Frederick Hirsch Pratik Datta Copyright © 2012 W3C ® ( MIT , ERCIM , Keio ), All Rights Reserved. W3C liability , trademark and document use rules apply. Abstract This document is the interop report for new features introduced in XML Signature 1.1. It includes the test cases and test results for these new features. It does not replicate interop testing performed for features retained from XML Signature 1.0. Status of This Document This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publications and the latest revision of this technical report can be found in the W3C technical reports index at http://www.w3.org/TR/. This document records the results of interop testing using the test cases referenced in this document. The Working Group has successfully completed interop testing but expects to update the references section of this document when XML Signature 1.1 advances to Recommendation. This document was published by the XML Security Working Group as a First Public Working Group Note. If you wish to make comments regarding this document, please send them to [email protected] ( subscribe , archives ). All feedback is welcome. Publication as a Working Group Note does not imply endorsement by the W3C Membership. This is a draft document and may be updated, replaced or obsoleted by other documents at any time. It is inappropriate to cite this document as other than work in progress. This document was produced by a group operating under the 5 February 2004 W3C Patent Policy . W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy . Table of Contents 1. Introduction 2. Elliptic Curve Algorithms (Interop testing completed) 2.1 Summary of Changes 2.2 Elliptic Curve Test Cases (not including SHA-224) 2.3 Elliptic Curve Test Results (not including SHA-224) 2.4 Elliptic Curve SHA-224 Test Cases 2.5 Elliptic Curve SHA-224 Test Results 3. SHA Algorithms (Interop testing completed) 3.1 Summary of Changes 3.2 SHA Test Cases (not including SHA-224) 3.3 SHA Test Results (not including SHA-224) 3.4 SHA-224 Test Cases 3.5 SHA-224 Test Results 4. X509Data Additions 4.1 Summary of Changes 4.2 X509Data Test Cases 4.3 X509Data Test Results 5. KeyInfo Additions 5.1 Summary of Changes 5.2 KeyInfo Test Cases 5.3 KeyInfo Test Results 6. HMACOutputLength verification 6.1 Summary of Changes 6.2 HMACOutputLength Test Cases 6.3 HMACOutputLength Test Results 7. Additional Algorithm additions and changes (previously interop tested) A. References A.1 Informative references 1. Introduction This document summarizes interop tests and the test results for new features introduced in XML Signature 1.1 [ XMLDSIG-CORE1 ]. Changes to XML Signature introduced in XML Signature 1.1 are summarized in a detailed change explanation document [ XMLDSIG-CORE1-CHGS ]. Tests that are marked 'Y' are completed, 'U' means 'untested' and should not be taken to make a statement about the implementation (as testing may simply not have been performed for interop due to timing or other reasons). 2. Elliptic Curve Algorithms (Interop testing completed) 2.1 Summary of Changes Add Elliptic Curve signature algorithms: ECDSA-SHA1 ( optional ), ECDSA-SHA224 ( optional ), ECDSA-SHA256 ( required ), ECDSA-SHA384 ( optional ), and ECDSA-SHA512 ( optional ) Add new KeyInfo child element - ECKeyValue (includes ECParameters ) Added profile of RFC 4050 with respect to ECDSA key formats. 2.2 Elliptic Curve Test Cases (not including SHA-224) Various combinations of the following Digest algorithm - SHA1/256/384/512 Signature algorithm - ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512) Canonicalization algorithm - C14N 1.0, Exc C14N 1.0 KeyInfo format - RFC 4050 style ECDSA KeyValue, XML signature 1.1 style ECKeyValue Microsoft's test vectors - 48 files 12 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512), RFC4050 ECDSAKeyValue 12 files: All of the above but with Exclusive C14N 1.0 12 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512), XML Signature 1.1 ECKeyValue 12 files: All of the above but with Exclusive C14N 1.0 Oracle's test vectors - 18 files 12 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = ECDSA (P256/P384/P521 with SHA1/SHA256/SHA384/SHA512), RFC4050 ECDSAKeyValue 12 files: all of the above XML Signature 1.1 ECKeyValue 2.3 Elliptic Curve Test Results (not including SHA-224) Participants: Oracle, Microsoft Each participant has verified all of these files. See test file directory . Signature Algorithm Digest Canonicalization ECKeyValue Microsoft Oracle ECDSA (P256/P384/P521] with SHA-1 Excl C14N ECKeyValue Y Y ECDSA (P256/P384/P521] with SHA-256 Excl C14N ECKeyValue Y Y ECDSA (P256/P384/P521] with SHA-384 Excl C14N ECKeyValue Y Y ECDSA (P256/P384/P521] with SHA-512 Excl C14N ECKeyValue Y Y 2.4 Elliptic Curve SHA-224 Test Cases The following are the SHA-224 tests: interop/xmldsig11/oracle/signature-enveloping-p256_sha224.xml interop/xmldsig11/oracle/signature-enveloping-p384_sha224.xml interop/xmldsig11/oracle/signature-enveloping-p521_sha224.xml 2.5 Elliptic Curve SHA-224 Test Results Signature Algorithm Digest Oracle Apache Santuario (C++) ECDSA (P256/P384/P521] with SHA-224 Y Y 3. SHA Algorithms (Interop testing completed) 3.1 Summary of Changes Add digest algorithms: SHA224 ( optional ), SHA256 ( required ), SHA384 ( optional ), SHA512 ( optional ) Add RSA signing algorithms: RSAwithSHA224 ( optional ), RSAwithSHA256 ( required ), RSAwithSHA384 ( optional ), RSAwithSHA512 ( optional ) Add HMAC-SHA224 ( optional ) Changed HMAC-SHA256 to required Changed HMAC-SHA384 , HMAC-SHA512 to recommended (from optional ). Discourage use of SHA-1 but allow it for compatibility SHA-1 use is DISCOURAGED (but support is still required ). Added text to SHA-1 to state that use is DISCOURAGED (but still required ). Added text to HMAC-SHA1 to state that use is DISCOURAGED Change so that DSAwithSHA1 is only required as Signature algorithm for Signature verification, but is optional for Signature generation. Previously it was required for both. Added text to indicate that use of RSA-SHA1 and ECDSA-SHA1 is DISCOURAGED. 3.2 SHA Test Cases (not including SHA-224) Various combinations of the following Digest algorithm - SHA1/256/384/512 Signature algorithm - DSA-SHA1, RSA 1024/2048-SHA256/384/512, HMAC-SHA256/384/512 Canonicalization algorithm - C14N 1.0, C14N 1.1, Exc C14N 1.0 Sun's test vectors - 18 files 3 files: Digest = SHA1, Signature = HMAC-SHA256 / HMAC-SHA384 / HMAC-SHA512, Canonicalization = C14N 1.1 3 files: Digest = SHA1, Signature = RSA-SHA256 / RSA-SHA384 / RSA-SHA512, Canonicalization = C14N 1.1 3 files: Digest = SHA-256/ SHA-384 / SHA-512, Signature = RSA-SHA256, Canonicalization = C14N 1.1 9 files: All of the above repeated for C14n 1.0 Oracle's test vectors - 9 files (same as sun's, C14n 1.0 only) 3 files: Digest = SHA1, Signature = HMAC-SHA256 / HMAC-SHA384 / HMAC-SHA512, Canonicalization = C14N 1.0 3 files: Digest = SHA1, Signature = RSA-SHA256 / RSA-SHA384 / RSA-SHA512, Canonicalization = C14N 1.0 3 files: Digest = SHA-256/ SHA-384 / SHA-512, Signature = RSA-SHA256, CCanonicalization = C14N 1.0 Microsoft's test vectors - 14 files 2 files: Digest = SHA1, Signature = DSA-SHA1, Canonicalization = C14N1.0 / Exc C14N 1.0 4 files: Digest = SHA1, Signature = HMAC-SHA1/HMAC-SHA256/HMAC-SHA384/HMAC-SHA512, Canonicalization = Exc C14N 1.0 8 files: Digest = SHA1/SHA256/SHA384/SHA512, Signature = RSA2048-SHA1/RSA2048-SHA256/RSA2048-SHA384/RSA2048-SHA512, Canonicalization = C14n 1.0 / Exc C14N 1.0 HMAC key All of Sun signatures are use "secret" All of Oracle's signature use "testkey" Microsoft's signatures use keys that are stored in the files secret-sha1.hmac, secret-sha256.hmac, secret-sha384.hmac, secret-sha512.hmac 3.3 SHA Test Results (not including SHA-224) Partipants: Oracle, Microsoft, Sun Each participant has verified all of the files in the interop test directory . (except Microsoft not verifying C14N 1.1). Digest Signature Canonicalization Sun Oracle SHA-1 RSA-SHA256 C14N1.0 Y Y SHA-1 RSA-SHA384 C14N1.0 Y Y SHA-1 RSA-SHA512 C14N1.0 Y Y SHA-1 HMAC-SHA256 C14N1.0 Y Y SHA-1 HMAC-SHA384 C14N1.0 Y Y SHA-1 HMAC-SHA512 C14N1.0 Y Y SHA-384 RSA-SHA256 C14N1.0 Y Y SHA-512 RSA-SHA256 C14N1.0 Y Y 3.4 SHA-224 Test Cases interop/xmldsig11/oracle/signature-enveloping-hmac-sha224.xml interop/xmldsig11/oracle/signature-enveloping-rsa-sha224.xml interop/xmldsig11/oracle/signature-enveloping-sha224-rsa_sha256.xml 3.5 SHA-224 Test Results Digest Signature Oracle Apache Santuario (C++) SHA-224 RSA-SHA224 Y Y SHA-224 RSA-SHA256 Y Y SHA-224 HMAC-SHA224 Y Y 4. X509Data Additions 4.1 Summary of Changes Add dsig11:X509Digest to list of elements that may be included, to support reference via base64-encoded digest of a certificate Note: X509Digest was added to correct issues with X509IssuerSerial . 4.2 X509Data Test Cases X509Digest : interop/xmldsig11/oracle/signature-enveloping-x509digest-rsa.xml 4.3 X509Data Test Results Item OpenSAML (Shibboleth) Oracle X509Digest Y Y 5. KeyInfo Additions 5.1 Summary of Changes Add new DEREncodedKeyValue KeyInfo child element Add sections on how to use additional KeyInfo child elements Describe use of XML Encryption EncryptedKey and DerivedKey Elements Add DEREncodedKeyValue - new representation for public keys Add KeyInfoReference - alternative to RetrievalMethod access to a KeyInfo element that does not require use of a Transform 5.2 KeyInfo Test Cases DEREncodedKeyValue with ECKey: interop/xmldsig11/oracle/signature-enveloping-derencoded-ec.xml DEREncodedKeyValue with RSAKey: interop/xmldsig11/oracle/signature-enveloping-derencoded-rsa.xml KeyInfoReference : interop/xmldsig11/oracle/signature-enveloping-keyinforeference-rsa.xml 5.3 KeyInfo Test Results Item Apache Santuario (C++) OpenSAML (Shibboleth) Oracle DEREncodedKeyValue (both EC and RSA) Y U Y KeyInfoReference U Y Y Note: Same author for both Apache Santuario (C++) and OpenSAML (Shibboleth) implementations. In OpenSaml reproduced the X509Digest material by consuming the same keypair and successfully processing the KeyInfoReference after copying it into a SAML document. 6. HMACOutputLength verification 6.1 Summary of Changes Added minimum output length for HMACOutputLength parameter in SignatureMethod . Verify that signature is deemed invalid if HMacOutputLength truncation length is below the larger of (a) half the underlying hash algorithm's output length, and (b) 80 bits. Test that error generated for SHA-256 with truncation length is less than 128, e.g. 100 bits [ RFC4868 ]. 6.2 HMACOutputLength Test Cases The following are test vectors for HMACOutputLength verification: interop/xmldsig11/oracle/signature-enveloping-hmac-sha1-truncated40.xml interop/xmldsig11/oracle/signature-enveloping-hmac-sha1-truncated160.xml The first one is truncated to 40 bytes, so it should be rejected. The second one is not truncated at all, so it should be accepted. 6.3 HMACOutputLength Test Results HMACOutputLength Oracle Apache Santuario (C++) Truncated 40 (invalid) Y Y Truncated 160 (valid) Y Y 7. Additional Algorithm additions and changes (previously interop tested) The following algorithms were added or changed in XML Signature 1.1 but were not included in this round of interop testing as they have been previously tested during the development of the corresponding W3C Recommendations: Add Exclusive XML Canonicalization 1.0 (omits comments) required . Tested with development of [ XML-EXC-C14N ]. Add Exclusive XML Canonicalization 1.0 (with Comments) recommended . Tested with development of [ XML-EXC-C14N ]. Add XPath Filter 2.0 as recommended transform algorithm. (alternative to URI fragment identifiers). Tested with development of [ XMLDSIG-XPATH-FILTER2 ]. Changed DSA and RSA KeyValue formats to required from recommended . Tested with development of [ XMLDSIG-CORE ]. A. References A.1 Informative references [RFC4868] S. Kelly, S. Frankel. Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec IETF RFC 4868. May 2007. URL: http://www.ietf.org/rfc/rfc4868.txt [XML-EXC-C14N] Donald E. Eastlake 3rd; Joseph Reagle; John Boyer. Exclusive XML Canonicalization Version 1.0. 18 July 2002. W3C Recommendation. URL: http://www.w3.org/TR/2002/REC-xml-exc-c14n-20020718/ [XMLDSIG-CORE] Joseph Reagle; et al. XML Signature Syntax and Processing (Second Edition). 10 June 2008. W3C Recommendation. URL: http://www.w3.org/TR/2008/REC-xmldsig-core-20080610 [XMLDSIG-CORE1] D. Eastlake, J. Reagle, D. Solo, F. Hirsch, T. Roessler, K. Yiu. XML Signature Syntax and Processing Version 1.1. 18 October 2012. W3C Last Call Working Draft. (Work in progress) URL: http://www.w3.org/TR/2012/WD-xmldsig-core1-20121018/ [XMLDSIG-CORE1-CHGS] Frederick Hirsch. Functional Explanation of Changes in XML Signature 1.1 . 18 October 2012. W3C Working Group Note. URL: http://www.w3.org/TR/2012/NOTE-xmldsig-core1-explain-20121018/ [XMLDSIG-XPATH-FILTER2] Merlin Hughes; John Boyer; Joseph Reagle. XML-Signature XPath Filter 2.0. 8 November 2002. W3C Recommendation. URL: http://www.w3.org/TR/2002/REC-xmldsig-filter2-20021108/