[
https://issues.apache.org/jira/browse/CXF-8162?focusedWorklogId=350939&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-350939
]
ASF GitHub Bot logged work on CXF-8162:
---------------------------------------
Author: ASF GitHub Bot
Created on: 28/Nov/19 12:19
Start Date: 28/Nov/19 12:19
Worklog Time Spent: 10m
Work Description: coheigea commented on pull request #604: [CXF-8162] JWE
with multiple recipients does not work for AES CBC Encryption
URL: https://github.com/apache/cxf/pull/604
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 350939)
Time Spent: 20m (was: 10m)
> JWE with multiple recipients does not work for AES CBC Encryption
> -----------------------------------------------------------------
>
> Key: CXF-8162
> URL: https://issues.apache.org/jira/browse/CXF-8162
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Affects Versions: 3.3.4
> Reporter: Frederik Libert
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: 3.4.0, 3.3.5
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> When encrypting for multiple recipients, the plaintext, the CEK, JWE
> Initialization Vector, and JWE Protected Header are shared by all recipients
> (which must be the case, since
> the ciphertext and Authentication Tag are also shared).
> The Apache CXF API for encrypting the content with AES GCM allows this by
> initializing a ContentEncryptionProvider of type
> AesGcmContentEncryptionAlgorithm which can be used as reference when
> initializing the list of JweEncryptionProviders (which take a
> KeyEncryptionProvider and an ContentEncryptionProvider).
> When using AES CBC, the API is different.
> The class AesCbcContentEncryptionAlgorithm is a private innerclass of
> JweEncryptionProvider AesCbcHmacJweEncryption so you can't initialize it once
> and reuse it in all JweEncryptionProviders of the list.
> There is a workaround as the API allows to build the CEK and
> InitializationVector yourself (not very nice), the API for AES CBC encryption
> should allow the initialization of the ContentEncryptionProvider from outside
> the JweEncryptionProvider so it can be referenced in all
> JweEncryptionProviders.
> Without that, you can only encrypt for 1 recipient or the validation will
> fail (invalid authentication tag) for all but 1 recipient.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
