Skip to content

Commit 909bf89

Browse files
GeoKbrentschmaltz
GeoK
authored and
brentschmaltz
committed
Add correct identifier for RSA-OAEP algorithm
http://www.w3.org/2001/04/xmlenc#rsa-oaep does not exist as an identifier for RSA-OAEP algorithm and it was introduced by a mistake. We will keep http://www.w3.org/2001/04/xmlenc#rsa-oaep, but we will treat it as http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p, for backwards compatibility reasons.
1 parent ab37a86 commit 909bf89

File tree

7 files changed

+23
-20
lines changed

7 files changed

+23
-20
lines changed

‎src/Microsoft.IdentityModel.Tokens/CryptoProviderFactory.cs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -603,7 +603,8 @@ private bool IsSupportedKeyWrapAlgorithm(string algorithm, SecurityKey key)
603603

604604
if (algorithm.Equals(SecurityAlgorithms.RsaPKCS1, StringComparison.Ordinal)
605605
|| algorithm.Equals(SecurityAlgorithms.RsaOAEP, StringComparison.Ordinal)
606-
|| algorithm.Equals(SecurityAlgorithms.RsaOaepKeyWrap, StringComparison.Ordinal))
606+
|| algorithm.Equals(SecurityAlgorithms.RsaOaepKeyWrap, StringComparison.Ordinal)
607+
|| algorithm.Equals(SecurityAlgorithms.RsaOaepMgf1pKeyWrap, StringComparison.Ordinal))
607608
{
608609
if (key is RsaSecurityKey)
609610
return true;
@@ -641,6 +642,7 @@ private bool IsSupportedRsaAlgorithm(string algorithm)
641642
case SecurityAlgorithms.RsaOAEP:
642643
case SecurityAlgorithms.RsaPKCS1:
643644
case SecurityAlgorithms.RsaOaepKeyWrap:
645+
case SecurityAlgorithms.RsaOaepMgf1pKeyWrap:
644646
return true;
645647
}
646648

‎src/Microsoft.IdentityModel.Tokens/SecurityAlgorithms.cs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ public static class SecurityAlgorithms
5151
public const string Ripemd160Digest = "http://www.w3.org/2001/04/xmlenc#ripemd160";
5252

5353
// See: https://www.w3.org/TR/xmlenc-core1/#sec-RSA-OAEP
54-
public const string RsaOaepKeyWrap = "http://www.w3.org/2001/04/xmlenc#rsa-oaep";
54+
public const string RsaOaepKeyWrap = "http://www.w3.org/2001/04/xmlenc#rsa-oaep"; // treat as http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p. RsaOaepKeyWrap identifier doesn't exist, but we released, so don't break now.
55+
public const string RsaOaepMgf1pKeyWrap = "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p";
5556

5657
// See: https://tools.ietf.org/html/rfc7518#section-4.1
5758
public const string Aes128KW = "A128KW";
@@ -117,7 +118,7 @@ public static class SecurityAlgorithms
117118
public const string Aes192CbcHmacSha384 = "A192CBC-HS384";
118119
public const string Aes256CbcHmacSha512 = "A256CBC-HS512";
119120

120-
internal const string DefaultAsymmetricKeyWrapAlgorithm = RsaOaepKeyWrap;
121+
internal const string DefaultAsymmetricKeyWrapAlgorithm = RsaOaepMgf1pKeyWrap;
121122
internal const string DefaultSymmetricEncryptionAlgorithm = Aes128Gcm;
122123

123124
#pragma warning restore 1591

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandlerTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1708,23 +1708,23 @@ public static TheoryData<CreateTokenTheoryData> RoundTripJWEKeyWrappingTheoryDat
17081708
ValidationParameters = Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
17091709
Payload = Default.PayloadString,
17101710
SigningCredentials = Default.SymmetricSigningCredentials,
1711-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256)
1711+
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256)
17121712
},
17131713
new CreateTokenTheoryData()
17141714
{
17151715
TestId = "RsaOaepKeyWrap-Aes192CbcHmacSha384",
17161716
ValidationParameters = Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
17171717
Payload = Default.PayloadString,
17181718
SigningCredentials = Default.SymmetricSigningCredentials,
1719-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384)
1719+
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384)
17201720
},
17211721
new CreateTokenTheoryData()
17221722
{
17231723
TestId = "RsaOaepKeyWrap-Aes256CbcHmacSha512",
17241724
ValidationParameters = Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
17251725
Payload = Default.PayloadString,
17261726
SigningCredentials = Default.SymmetricSigningCredentials,
1727-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes256CbcHmacSha512)
1727+
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes256CbcHmacSha512)
17281728
},
17291729
new CreateTokenTheoryData()
17301730
{
@@ -1748,7 +1748,7 @@ public static TheoryData<CreateTokenTheoryData> RoundTripJWEKeyWrappingTheoryDat
17481748
ValidationParameters = Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
17491749
Payload = Default.PayloadString,
17501750
SigningCredentials = Default.SymmetricSigningCredentials,
1751-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384)
1751+
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384)
17521752
}
17531753
};
17541754
}

‎test/Microsoft.IdentityModel.Tokens.Tests/EncryptingCredentialsTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ public static TheoryData<EncryptingCredentialsTheoryData> ConstructorATheoryData
8181
new EncryptingCredentialsTheoryData
8282
{
8383
Key = null,
84-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
84+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
8585
Enc = SecurityAlgorithms.Aes128CbcHmacSha256,
8686
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'key'"),
8787
TestId = "NullKey"
@@ -97,7 +97,7 @@ public static TheoryData<EncryptingCredentialsTheoryData> ConstructorATheoryData
9797
new EncryptingCredentialsTheoryData
9898
{
9999
Key = Default.AsymmetricEncryptionKeyPublic,
100-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
100+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
101101
Enc = String.Empty,
102102
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
103103
TestId = "EmptyEncString"
@@ -113,15 +113,15 @@ public static TheoryData<EncryptingCredentialsTheoryData> ConstructorATheoryData
113113
new EncryptingCredentialsTheoryData
114114
{
115115
Key = Default.AsymmetricEncryptionKeyPublic,
116-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
116+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
117117
Enc = null,
118118
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
119119
TestId = "NullEncString"
120120
},
121121
new EncryptingCredentialsTheoryData
122122
{
123123
Key = Default.AsymmetricEncryptionKeyPublic,
124-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
124+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
125125
Enc = SecurityAlgorithms.Aes128CbcHmacSha256,
126126
TestId = "ValidTest"
127127
}

‎test/Microsoft.IdentityModel.Tokens.Tests/KeyVaultVerify.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ public static TheoryData<KeyWrapTestParams> KeyWrapTheoryData
138138
rsaOaep = new RsaOaep();
139139
theoryData.Add(new KeyWrapTestParams
140140
{
141-
Algorithm = SecurityAlgorithms.RsaOaepKeyWrap,
141+
Algorithm = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
142142
KeyVaultEncryptor = rsaOaep.CreateEncryptor(KeyingMaterial.RsaSecurityKeyWithCspProvider_2048_Public.Rsa),
143143
KeyVaultDecryptor = rsaOaep.CreateDecryptor(KeyingMaterial.RsaSecurityKeyWithCspProvider_2048.Rsa),
144144
Key = KeyingMaterial.RsaSecurityKeyWithCspProvider_2048,

‎test/Microsoft.IdentityModel.Tokens.Tests/X509EncryptingCredentialsTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public static TheoryData<X509EncryptingCredentialsTheoryData> ConstructorsTheory
6666
new X509EncryptingCredentialsTheoryData
6767
{
6868
Certificate = null,
69-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
69+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
7070
Enc = SecurityAlgorithms.Aes128Gcm,
7171
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'certificate'"),
7272
TestId = "NullCertificate"
@@ -82,7 +82,7 @@ public static TheoryData<X509EncryptingCredentialsTheoryData> ConstructorsTheory
8282
new X509EncryptingCredentialsTheoryData
8383
{
8484
Certificate = Default.Certificate,
85-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
85+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
8686
Enc = String.Empty,
8787
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
8888
TestId = "EmptyEncString"
@@ -98,15 +98,15 @@ public static TheoryData<X509EncryptingCredentialsTheoryData> ConstructorsTheory
9898
new X509EncryptingCredentialsTheoryData
9999
{
100100
Certificate = Default.Certificate,
101-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
101+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
102102
Enc = null,
103103
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
104104
TestId = "NullEncString"
105105
},
106106
new X509EncryptingCredentialsTheoryData
107107
{
108108
Certificate = Default.Certificate,
109-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
109+
Alg = SecurityAlgorithms.RsaOaepMgf1pKeyWrap,
110110
Enc = SecurityAlgorithms.Aes128Gcm,
111111
TestId = "ValidTest"
112112
}

‎test/System.IdentityModel.Tokens.Jwt.Tests/CreateAndValidateTokens.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -823,23 +823,23 @@ public static TheoryData<string, SecurityTokenDescriptor, TokenValidationParamet
823823
ExpectedException.NoExceptionExpected
824824
);
825825

826-
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256);
826+
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256);
827827
theoryData.Add(
828828
"RsaOaepKeyWrap-Aes128CbcHmacSha256",
829829
Default.SecurityTokenDescriptor(encryptingCredentials, Default.SymmetricSigningCredentials, ClaimSets.DefaultClaims),
830830
Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
831831
ExpectedException.NoExceptionExpected
832832
);
833833

834-
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384);
834+
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384);
835835
theoryData.Add(
836836
"RsaOaepKeyWrap-Aes192CbcHmacSha384",
837837
Default.SecurityTokenDescriptor(encryptingCredentials, Default.SymmetricSigningCredentials, ClaimSets.DefaultClaims),
838838
Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
839839
ExpectedException.NoExceptionExpected
840840
);
841841

842-
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes256CbcHmacSha512);
842+
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes256CbcHmacSha512);
843843
theoryData.Add(
844844
"RsaOaepKeyWrap-Aes256CbcHmacSha512",
845845
Default.SecurityTokenDescriptor(encryptingCredentials, Default.SymmetricSigningCredentials, ClaimSets.DefaultClaims),
@@ -888,7 +888,7 @@ public static TheoryData<string, SecurityTokenDescriptor, TokenValidationParamet
888888
ExpectedException.NoExceptionExpected
889889
);
890890

891-
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384);
891+
encryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepMgf1pKeyWrap, SecurityAlgorithms.Aes192CbcHmacSha384);
892892
theoryData.Add(
893893
"RsaOaepKeyWrap-Aes192CbcHmacSha384",
894894
Default.SecurityTokenDescriptor(encryptingCredentials, Default.SymmetricSigningCredentials, ClaimSets.DefaultClaims),

0 commit comments

Comments
 (0)