Skip to content
Free planNo credit card requiredStart writing
AI for Research home
AI for Research home
Dashboard
Sign inGet started

Search 250 million research papers

Read the abstract, see who wrote it and who cites it, and get the citation in APA, MLA, Chicago or Harvard.

About 335 papers for “XML encryption”

XML Encryption and Signatures

Jason Bock, Pete Stromquist, Tom Fischer et al. · Apress eBooks · 2002

In this chapter, I'll talk about the Extensible Markup Language (XML) Encryption and Signatures specifications. These specifications are important for cryptography developers, as XML is now used in business data exchange and system interoperability protocols. This chapter will demonstrate how you can use .NET classes to help you sign and encrypt XML documents. Before you see how these classes work, let's start with a (very) brief tour of XML.

Cited by 0

How to break XML encryption – automatically

Dennis Kupser, Christian Mainka, Jörg Schwenk et al. · 2015

In the recent years, XML Encryption became a target of several new attacks [19, 18, 17]. These attacks belong to the family of adaptive chosen-ciphertext attacks, and al-low an adversary to decrypt symmetric and asymmetric XML ciphertexts, without knowing the secret keys. In order to protect XML Encryption implementations, the World Wide Web Consortium (W3C) published an up-dated version of the standard. Unfortunately, most of the current XML Encryption implementations do not support the newest XML En-cryption specification and offer different XML Security configurations to protect confidentiality of the exchanged messages. Resulting from the attack complexity, evalu-ation of the security configuration correctness becomes tedious and error prone. Validation of the applied coun-termeasures can typically be made with numerous XML messages provoking incorrect behavior by decrypting XML content. Up to now, this validation was only man-ually possible. In this paper, we systematically analyze the chosen-ciphertext attacks on XML Encryption and design an al-gorithm to perform a vulnerability scan on arbitrary en-crypted XML messages. The algorithm can automati-cally detect a vulnerability and exploit it to retrieve the plaintext of a message protected by XML Encryption. To assess practicability of our approach, we implemented an open source attack plugin for Web Service attacking tool called WS-Attacker. With the plugin, we discovered new security problems in four out of five analyzed Web Service implementations, including IBM Datapower or Apache CXF. ∗This is the full version of the paper with same title that was

Cited by 9

XBMRSA: A new XML encryption algorithm

N Nithin, Anupkumar M. Bongale · 2012

Extensible Markup Language (XML) is used to exchange messages across different networks due to its flexibility and adaptability. Due to the wide usage of XML documents over internet there arises a need to protect these documents to provide data confidentiality and privacy. There are various cryptographic algorithms proposed to encrypt XML documents to address the issue of security. In this paper we are proposing a new public key cryptographic algorithm called XML Batch Multi-Prime RSA (XBMRSA) to encrypt sections of XML document based on Multi-Prime RSA technique. A detailed comparative study of standard RSA and XBMRSA is carried out by considering parameters like time required to encrypt and decrypt the XML file and size of the encrypted file. XBMRSA has provided better results as it takes less time to encrypt and decrypt the XML data.

Cited by 4

A stream-based implementation of XML encryption

Takeshi Imamura, Andy Clark, Hiroshi Maruyama · 2002

W3C has been working on the standardization of XML Encryption and released its specification as a W3C Proposed Recommendation in 2002. There are several implementations of the specification, all of which are implemented using DOM. However, it is commonly accepted that DOM has higher costs in time and space than other APIs. Also, even if SAX is used, with this kind of API, it is impossible to parse decrypted data both efficiently and correctly. Therefore, we thought of using the Xerces Native Interface (XNI) of Xerces2. Using this API, we prototyped a stream-based implementation of the specification. We also evaluated its performance. As compared with a DOM-based implementation, it achieves a 0.27%--26% reduction in processing time (i.e., 1.0x-1.3x performance) for encryption of XML documents with sizes larger than 2 KB, and 34%-88% (i.e., 1.5x-8.5x) for decryption of XML documents with any sizes.

Cited by 21

A stream-based implementation of XML encryption

Takeshi Imamura, Andy Clark, Hiroshi Maruyama · 2002

W3C has been working on the standardization of XML Encryption and released its specification as a W3C Proposed Recommendation in 2002. There are several implementations of the specification, all of which are implemented using DOM. However, it is commonly accepted that DOM has higher costs in time and space than other APIs. Also, even if SAX is used, with this kind of API, it is impossible to parse decrypted data both efficiently and correctly. Therefore, we thought of using the Xerces Native Interface (XNI) of Xerces2. Using this API, we prototyped a stream-based implementation of the specification. We also evaluated its performance. As compared with a DOM-based implementation, it achieves a 0.27%--26% reduction in processing time (i.e., 1.0x-1.3x performance) for encryption of XML documents with sizes larger than 2 KB, and 34%-88% (i.e., 1.5x-8.5x) for decryption of XML documents with any sizes.

Cited by 6

Xml Base Secured Data Encryption and Transmission Technology

Md. Shamsuzzaman Sobuz · Daffodil International University Journal of Science and Technology · 2013

With the development of data transmission and Web Service technology, XML is widely used in all kinds of information transformation. So, Security in XML data transmission is very important, nowadays, in most of the sensitive issue like Bank transaction, online transaction, e-commerce, Diplomatic data etc. For secure XML Transaction, several methods are proposed. We will study the technologies of secure XML transmission which propose the XML's security encryption based on the importance and sensitivity of data.

Cited by 0Open access

A comprehensive presentation to XML signature and encryption

A. A. Abd El-Aziz, A. Kannan · 2013

XML has been widely adopted for information exchange across various networks due to flexibility providing common syntax for messaging systems. XML documents may contain private information that cannot be shared by all user communities. Therefore, XML Security has a great importance to the overall security of the distributed systems. In this paper, we provide a comprehensive tutorial on XML security standards. The presented standards include XML signature and XML encryption. We describe how to create and verify XML signature and how to encrypt and decrypt XML data. This paper should serve as a roadmap for future research and basis for further exploration of relevant scientific literature and standard specifications.

Cited by 2

Secure XML: The New Syntax for Signatures and Encryption

Donald Eastlake, Kitty Niles · CERN Document Server (European Organization for Nuclear Research) · 2002

From the Book: Secure XML explains the guts of XML Digital Signatures and XML Encryption and how you, as a designer, implementer, or evaluator of an XML application, can make use of these technologies. The Extensible Markup Language (XML) is rapidly becoming the new standard in application level computer communications. As its use widens, mechanisms to assure that XML documents and messages are authentic and can be communicated confidentially, become essential. Material provided in this book minimizes needed pre-requisite knowledge, although it requires general familiarity with computer concepts. For the reader not familiar with digital security or cryptology concepts, Part I includes a chapter covering these topics in the depth needed to understand the remainder of the book. For the reader not familiar with XML, Part II provides in depth coverage of XML and related standards. This XML material provides not just the background needed for the rest of this book, but sufficiently general coverage that it should be helpful in understanding most XML applications and systems. Readers with sufficient knowledge in the areas covered can skip or skim these background parts. After the introductory and background material in Parts I and II, the topics of XML Digital Signatures, XML Encryption, and XML Canonicalization are covered in depth. This includes specific formats and examples and covers keying material, combined use of signature and encryption, algorithms, and profiling of signature use for particular applications. If your interest is only in XML Digital Signatures or XML Encryption can skip the Chapters associated with the other topic. But any non-trivial use of XML Security willrequire some familiarity with XML Canonicalization, keying information, and the relevant algorithms.Using this book, a skilled reader can design and implement interoperable XML based authentication and/or confidentiality mechanisms for their particular applications. This book is firmly based on the official adopted standards of the World Wide Web Consortium, Internet Engineering Task Force, and other relevant standards bodies when available. Material going beyond that is based on the most recent drafts or informational documents available at the time of writing and the personal knowledge and experiences of the authors. In general, areas of XML Security are presented by giving an informal syntax with a skeletal example, followed by the formal syntax and then a number of more complete examples. The material is organized so that the formal syntax and complete examples can be read in either order. Throughout the book, notes are included that might be of interest to the reader, where the authors either have some particular knowledge of the history involved or have some heretical opinion.

Cited by 18

Encryption & Hiding Information in Internet Files HTML & XML

Dujan B. Taha, Ahmed Nori, Najla Badie Ibraheem · Maǧallaẗ al-rāfidayn li-ʿulūm al-ḥāsibāt wa-al-riyāḍiyyāẗ/˜Al-œRafidain journal for computer sciences and mathematics · 2010

In order to achieve communication security, cryptography and information hiding in different media are used. In this work, a system for hiding text in Internet files namely, HTML and XML has been built. Two proposed algorithms have been designed and implemented to embed and extract secret information from these files. Hiding in HTML files was done by first encrypting the message using Linear Feedback Shift Register (LFSR) and embed the encryption key into the HTML tags. Then, the encrypted secret message was embedded into an image in the HTML page. Hiding in XML files was achieved using non linear feed back shift register to encrypt the secret message. The resultant encryption key was embedded inside XML definition file namely, Document Type Definition (DTD) file which is invisible to the user. The encrypted message was embedded inside the XML component of the file. Experimental results demonstrated that the proposed algorithms are secure and efficient. The image carrying the secret information is identical (by Human Visual System HVS) to the original image as well as the ability to embed a lot of information inside the files. Visual C++ was used to access Internet files whereas Matlab Version 7 was used to implement the used encryption methods and graphical user interface.

Cited by 0Open access

Technical Analysis of Countermeasures against Attack on XML Encryption -- or -- Just Another Motivation for Authenticated Encryption

Juraj Somorovsky, Jörg Schwenk · 2012

At CCS'11 a new chosen-ciphertext attack on XML Encryption [13] has been presented. This attack is of high relevance, since it allows one to decrypt arbitrary encrypted XML payload by issuing 14 server requests per byte on average. In this paper we discuss several countermeasures against this attack, which have been considered by different framework developers for different scenarios. We analyze the scenarios and show why these countermeasures do not work. Thereby, we motivate for the application of authenticated encryption in the XML Encryption specification.

Cited by 11

A Layered Approach to XML Canonicalization (A Position Paper for the W3C Workshop on Next Steps for XML Signature and XML Encryption)

Xmlsec Inc · 2013

XML Canonicalization enables reliable textual and binary comparison of XML documents through the removal of irrelevant differences in structure and content. Though XML Canonicalization is critical for XML Signatures, it also has value in other XML applications such as version control. Currently, the approach to XML Canonicalization is to write a single specification that details how all parts of XML instances are to be canonicalized. This position paper suggests an alternative approach in which canonicalization is specified separately for the different layers in XML data stack (core, schema, and namespace). In this way, an application can select different canonicalization methods for the different layers; this allows the customization of canonicalization to the application's needs while simplifying the task of writing canonicalization specifications because the specifications need not be all encompassing. As well, it may also be feasible to canonicalize data belonging to different namespaces differently; for example, numbers in an accounting spreadsheet could be canonicalized differently than numbers appearing in descriptive text. Description Three layers of canonicalization are proposed: core, schema-aware, and namespace-aware. They are described in the following table.

Cited by 0

Enhanced XML Encryption Using Classification Mining Technique for e-Banking Transactions

Faisal T. Ammari, Joan Lu · International Journal of Information Retrieval Research · 2013

In this paper a novel approach is presented for securing financial Extensible Markup Language (XML) transactions using classification data mining (DM) algorithms. The authors' strategy defines the complete process of classifying XML transactions by using set of classification algorithms, classified XML documents processed at later stage using element-wise encryption. Classification algorithms were used to identify the XML transaction rules and factors in order to classify the message content fetching important elements within. The authors have implemented two classification algorithms to fetch the importance level value within each XML document. Classified content is processed using element-wise encryption for selected parts with “High” or “Medium” importance level values. Element-wise encryption is performed using AES symmetric encryption algorithm with different key sizes. An implementation has been conducted using data set fetched from e-banking service in one of the leading banks in Jordan to present system functionality and efficiency. Results from the authors' implementation presented an improvement in processing time encrypting XML documents.

Cited by 1

Secured Management of Online XML Document Services through Structure Preserving Asymmetric Encryption

Jean-Yves Vion-Dury · Balisage series on markup technologies · 2011

Externalizing document management is a problem when individual or corporate privacy is to be ensured. Provided that the decryption key is not known from service side, pure storage/archiving of encrypted documents is highly secure, but of poor interest as no operation can be performed on hosted data. Thus, current document management systems offer restricted privacy mechanisms, roughly based on secured communication channels and sometimes encrypted storage. However, many value-added processing operations require decrypting the document, and no formal guaranty is granted regarding the safety of system behaviors. As an example of known issue, there is the problem of data remanence (persisting information on disk after file system deletion), bugs or viruses acting on various level of the software architecture. This paper describes a method to allow restricted (but yet meaningful) ways of processing encrypted XML documents without needing decryption phase. The encryption process we propose allows isomorphic encryption of data (XML document owned by customers) and operator transformations (verification and transformation operated by the Service Provider) in such a way that full secrecy is ensured simply because the decoding key is not known by the Service Provider. Once transformed, operators can handle encrypted documents with equivalent results up to the decryption operation.

Cited by 1Open access