From 305f9049296b71028fbb3924bd74c2e4e9a0638a Mon Sep 17 00:00:00 2001 From: Andreas Martens Date: Mon, 26 Oct 2026 08:31:22 +0000 Subject: [PATCH 1/2] RAMPART-462: Use AlgorithmSuite encryption algorithm for symmetric key generation --- .../rampart/builder/SymmetricBindingBuilder.java | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/rampart-core/src/main/java/org/apache/rampart/builder/SymmetricBindingBuilder.java b/modules/rampart-core/src/main/java/org/apache/rampart/builder/SymmetricBindingBuilder.java index 85b6b701..b48cca05 100644 --- a/modules/rampart-core/src/main/java/org/apache/rampart/builder/SymmetricBindingBuilder.java +++ b/modules/rampart-core/src/main/java/org/apache/rampart/builder/SymmetricBindingBuilder.java @@ -757,12 +757,13 @@ private String setupEncryptedKey(RampartMessageData rmd, Token sigToken) throws RampartException { try { KeyGenerator keyGen; - try { - keyGen = KeyUtils.getKeyGenerator(WSConstants.AES_128); - } catch (WSSecurityException e) { - e.printStackTrace(); - return null; - } + try { + String encrAlgo = rmd.getPolicyData().getAlgorithmSuite().getEncryption(); + keyGen = KeyUtils.getKeyGenerator(encrAlgo != null ? encrAlgo : WSConstants.AES_128); + } catch (WSSecurityException e) { + e.printStackTrace(); + return null; + } SecretKey symmetricKey = keyGen.generateKey(); WSSecEncryptedKey encrKey = this.getEncryptedKeyBuilder(rmd, sigToken, From 4d759f89b150314986afd1df36c00bb8c6e64d56 Mon Sep 17 00:00:00 2001 From: Andreas Martens Date: Mon, 26 Oct 2026 11:56:45 +0000 Subject: [PATCH 2/2] RAMPART-462: Add test for AlgorithmSuite-driven symmetric key size --- .../rampart/SymmetricBindingBuilderTest.java | 37 +++++++++ .../rampart-symm-binding-6-basic256.xml | 76 +++++++++++++++++++ 2 files changed, 113 insertions(+) create mode 100644 modules/rampart-tests/test-resources/policy/rampart-symm-binding-6-basic256.xml diff --git a/modules/rampart-tests/src/test/java/org/apache/rampart/SymmetricBindingBuilderTest.java b/modules/rampart-tests/src/test/java/org/apache/rampart/SymmetricBindingBuilderTest.java index 4f42fb09..a95b6792 100644 --- a/modules/rampart-tests/src/test/java/org/apache/rampart/SymmetricBindingBuilderTest.java +++ b/modules/rampart-tests/src/test/java/org/apache/rampart/SymmetricBindingBuilderTest.java @@ -21,6 +21,8 @@ import javax.xml.namespace.QName; import org.apache.axis2.context.MessageContext; +import org.apache.rahas.TokenStorage; +import org.apache.rahas.TrustUtil; import org.apache.neethi.Policy; import org.apache.wss4j.dom.WSConstants; import org.apache.wss4j.common.derivedKey.ConversationConstants; @@ -49,6 +51,41 @@ public void testSymmBinding() throws Exception { this.verifySecHeader(list.iterator(), ctx.getEnvelope()); } + /** + * RAMPART-462: the symmetric key generated for an X509 protection token must follow the + * encryption algorithm of the policy's AlgorithmSuite (here Basic256 = AES-256) instead of + * always being AES-128. + */ + public void testSymmBindingBasic256() throws Exception { + MessageContext ctx = getMsgCtx(); + + String policyXml = "test-resources/policy/rampart-symm-binding-6-basic256.xml"; + + Policy policy = this.loadPolicy(policyXml); + + ctx.setProperty(RampartMessageData.KEY_RAMPART_POLICY, policy); + + MessageBuilder builder = new MessageBuilder(); + builder.build(ctx); + + ArrayList list = new ArrayList(); + + list.add(new QName(WSConstants.WSU_NS, WSConstants.TIMESTAMP_TOKEN_LN)); + list.add(new QName(WSConstants.ENC_NS, WSConstants.ENC_KEY_LN)); + list.add(new QName(WSConstants.ENC_NS, WSConstants.REF_LIST_LN)); + list.add(new QName(WSConstants.SIG_NS, WSConstants.SIG_LN)); + + this.verifySecHeader(list.iterator(), ctx.getEnvelope()); + + // The session key generated by SymmetricBindingBuilder is kept in the token store + TokenStorage store = TrustUtil.getTokenStore(ctx); + String[] ids = store.getTokenIdentifiers(); + assertEquals("Expected exactly one generated key", 1, ids.length); + byte[] secret = store.getToken(ids[0]).getSecret(); + assertNotNull(secret); + assertEquals("Basic256 requires a 256-bit (32 byte) AES key", 32, secret.length); + } + // public void testSymmBindingServerSide() { // // try { diff --git a/modules/rampart-tests/test-resources/policy/rampart-symm-binding-6-basic256.xml b/modules/rampart-tests/test-resources/policy/rampart-symm-binding-6-basic256.xml new file mode 100644 index 00000000..e69a6eb4 --- /dev/null +++ b/modules/rampart-tests/test-resources/policy/rampart-symm-binding-6-basic256.xml @@ -0,0 +1,76 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + alice + bob + org.apache.rampart.TestCBHandler + + + + pkcs12 + test-resources/keys/interop2024.pkcs12 + password + + + + + pkcs12 + test-resources/keys/interop2024.pkcs12 + password + + + + + + + +