Skip to content
This repository has been archived by the owner. It is now read-only.

Commit

Permalink
Validate cryptographic algorithms in metadata.
Browse files Browse the repository at this point in the history 
Covers EncryptionMethod, SigningMethod and DigestMethod elements.
  • Loading branch information
@iay
iay committed Jan 22, 2015
1 parent 95446e3 commit adbe510
Show file tree
Hide file tree
Showing 2 changed files with 208 additions and 0 deletions.
195 changes: 195 additions & 0 deletions mdx/_rules/check_uk_algorithms.xsl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,195 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
check_uk_algorithms.xsl
Checking ruleset for cryptographic algorithms. This is named as a UK
ruleset because the division between acceptable and unacceptable algorithms
is sometimes a judgement call; however, it should be generally
applicable.
The best reference for *all* URIs used as algorithm identifiers is the
XML Security Algorithm Cross-Reference at http://www.w3.org/TR/xmlsec-algorithms/
Algorithm lists here are in the same order as in that document.
Author: Ian A. Young <ian@iay.org.uk>
-->
<xsl:stylesheet version="1.0"
xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">

<!--
Common support functions.
-->
<xsl:import href="check_framework.xsl"/>

<!--
*************************************
*** ***
*** S I G N I N G M E T H O D ***
*** ***
*************************************
-->

<!--
Check for known BAD SigningMethod algorithms.
-->
<xsl:template match="alg:SigningMethod[
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-md5'
]">
<xsl:call-template name="error">
<xsl:with-param name="m">
<xsl:text>insecure algorithm in SigningMethod: '</xsl:text>
<xsl:value-of select="@Algorithm"/>
<xsl:text>'</xsl:text>
</xsl:with-param>
</xsl:call-template>
</xsl:template>

<!--
Check for known GOOD SigningMethod algorithms.
-->
<xsl:template match="alg:SigningMethod[
@Algorithm = 'http://www.w3.org/2000/09/xmldsig#dsa-sha1' or
@Algorithm = 'http://www.w3.org/2009/xmldsig11#dsa-sha256' or
@Algorithm = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512'
]">
<!-- do nothing -->
</xsl:template>

<!--
Misspelled or otherwise not known SigningMethod algorithms.
-->
<xsl:template match="alg:SigningMethod">
<xsl:call-template name="error">
<xsl:with-param name="m">
<xsl:text>unknown algorithm in SigningMethod: '</xsl:text>
<xsl:value-of select="@Algorithm"/>
<xsl:text>'</xsl:text>
</xsl:with-param>
</xsl:call-template>
</xsl:template>

<!--
***********************************
*** ***
*** D I G E S T M E T H O D ***
*** ***
***********************************
-->

<!--
Check for known BAD DigestMethod algorithms.
-->
<xsl:template match="alg:DigestMethod[
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#md5'
]">
<xsl:call-template name="error">
<xsl:with-param name="m">
<xsl:text>insecure algorithm in DigestMethod: '</xsl:text>
<xsl:value-of select="@Algorithm"/>
<xsl:text>'</xsl:text>
</xsl:with-param>
</xsl:call-template>
</xsl:template>

<!--
Check for known GOOD DigestMethod algorithms.
-->
<xsl:template match="alg:DigestMethod[
@Algorithm = 'http://www.w3.org/2000/09/xmldsig#sha1' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#sha224' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#sha256' or
@Algorithm = 'http://www.w3.org/2001/04/xmldsig-more#sha384' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#sha512' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#ripemd160'
]">
<!-- do nothing -->
</xsl:template>

<!--
Misspelled or otherwise not known DigestMethod algorithms.
-->
<xsl:template match="alg:DigestMethod">
<xsl:call-template name="error">
<xsl:with-param name="m">
<xsl:text>unknown algorithm in DigestMethod: '</xsl:text>
<xsl:value-of select="@Algorithm"/>
<xsl:text>'</xsl:text>
</xsl:with-param>
</xsl:call-template>
</xsl:template>

<!--
*******************************************
*** ***
*** E N C R Y P T I O N M E T H O D ***
*** ***
*******************************************
-->

<!--
Check for known BAD EncryptionMethod algorithms.
This list is of symmetric key encryption algorithms *and*
key transport algorithms.
-->
<xsl:template match="md:EncryptionMethod[
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'
]">
<xsl:call-template name="error">
<xsl:with-param name="m">
<xsl:text>insecure algorithm in EncryptionMethod: '</xsl:text>
<xsl:value-of select="@Algorithm"/>
<xsl:text>'</xsl:text>
</xsl:with-param>
</xsl:call-template>
</xsl:template>

<!--
Check for known GOOD EncryptionMethod algorithms.
This list is of symmetric key encryption algorithms *and*
key transport algorithms.
-->
<xsl:template match="md:EncryptionMethod[
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#aes128-cbc' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#aes192-cbc' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#aes256-cbc' or
@Algorithm = 'http://www.w3.org/2009/xmlenc11#aes128-gcm' or
@Algorithm = 'http://www.w3.org/2009/xmlenc11#aes192-gcm' or
@Algorithm = 'http://www.w3.org/2009/xmlenc11#aes256-gcm' or
@Algorithm = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p' or
@Algorithm = 'http://www.w3.org/2009/xmlenc11#rsa-oaep'
]">
<!-- do nothing -->
</xsl:template>

<!--
Misspelled or otherwise not known EncryptionMethod algorithms.
-->
<xsl:template match="md:EncryptionMethod">
<xsl:call-template name="error">
<xsl:with-param name="m">
<xsl:text>unknown algorithm in EncryptionMethod: '</xsl:text>
<xsl:value-of select="@Algorithm"/>
<xsl:text>'</xsl:text>
</xsl:with-param>
</xsl:call-template>
</xsl:template>

</xsl:stylesheet>
13 changes: 13 additions & 0 deletions mdx/validation-beans.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -652,6 +652,18 @@
*******************************************************************
-->

<!--
check_uk_algorithms
-->
<bean id="check_uk_algorithms" parent="XSLValidationStage"
p:id="check_uk_algorithms">
<property name="XSLResource">
<bean parent="FileSystemResource">
<constructor-arg value="${rulesdir}/check_uk_algorithms.xsl"/>
</bean>
</property>
</bean>

<!--
check_uk_trust
-->
Expand Down Expand Up @@ -804,6 +816,7 @@
<ref bean="check_saml2int"/>
<ref bean="check_saml2meta"/>
<ref bean="check_shibboleth"/>
<ref bean="check_uk_algorithms"/>
<ref bean="check_uk_trust"/>
</list>
</property>
Expand Down

0 comments on commit adbe510

Please sign in to comment.