XML Encryption
Encyclopedia
XML Encryption, also known as XML-Enc, is a specification, governed by a W3C
recommendation, that defines how to encrypt the contents of an XML
element.
Although XML Encryption can be used to encrypt any kind of data, it is nonetheless known as "XML Encryption" because an XML element (either an EncryptedData or EncryptedKey element) contains or refers to the cipher text, keying information, and algorithms.
Both XML Signature
and XML Encryption use the KeyInfo element, which appears as the child of a SignedInfo, EncryptedData, or EncryptedKey element and provides information to a recipient about what keying material to use in validating a signature or decrypting encrypted data.
The KeyInfo element is optional: it can be attached in the message, or be delivered through a secure channel.
XML Encryption is different from and unrelated to Transport Layer Security
, which is used to send encrypted messages (including xml content, both encrypted and otherwise) over the internet.
It has been reported that this specification has has severe security concerns.
World Wide Web Consortium
The World Wide Web Consortium is the main international standards organization for the World Wide Web .Founded and headed by Tim Berners-Lee, the consortium is made up of member organizations which maintain full-time staff for the purpose of working together in the development of standards for the...
recommendation, that defines how to encrypt the contents of an XML
XML
Extensible Markup Language is a set of rules for encoding documents in machine-readable form. It is defined in the XML 1.0 Specification produced by the W3C, and several other related specifications, all gratis open standards....
element.
Although XML Encryption can be used to encrypt any kind of data, it is nonetheless known as "XML Encryption" because an XML element (either an EncryptedData or EncryptedKey element) contains or refers to the cipher text, keying information, and algorithms.
Both XML Signature
XML Signature
XML Signature defines an XML syntax for digital signatures and is defined in the W3C recommendation . Functionally, it has much in common with PKCS#7 but is more extensible and geared towards signing XML documents...
and XML Encryption use the KeyInfo element, which appears as the child of a SignedInfo, EncryptedData, or EncryptedKey element and provides information to a recipient about what keying material to use in validating a signature or decrypting encrypted data.
The KeyInfo element is optional: it can be attached in the message, or be delivered through a secure channel.
XML Encryption is different from and unrelated to Transport Layer Security
Transport Layer Security
Transport Layer Security and its predecessor, Secure Sockets Layer , are cryptographic protocols that provide communication security over the Internet...
, which is used to send encrypted messages (including xml content, both encrypted and otherwise) over the internet.
It has been reported that this specification has has severe security concerns.