abstract
    this document specifies a process for encrypting data and representing the result in xml. the data may be arbitrary data (including an xml document), an xml element, or xml element content. the result of encrypting data is an xml encryption element which contains or references the cipher data.

    status of this document
    this document is the w3c xml encryption recommendation (rec). this document has been reviewed by w3c members and other interested parties and has been endorsed by the director as a w3c recommendation. it is a stable document and may be used as reference material or cited as a normative reference from another document. w3c's role in making the recommendation is to draw attention to the specification and to promote its widespread deployment. this enhances the functionality and interoperability of the web.

    this specification was produced by the w3c xml encryption working group (activity) which believes the specification is sufficient for the creation of independent interoperable implementations as demonstrated in the interoperability report.

    patent disclosures relevant to this specification may be found on the working group's patent disclosure page in conformance with w3c policy.

    please report errors in this document to xml-encryption@w3.org (public archive).

    the list of known errors in this specification is available at http://www.w3.org/encryption/2002/12-xmlenc-errata.

    the english version of this specification is the only normative version. information about translations of this document (if any) is available http://www.w3.org/encryption/2002/12-xmlenc-translations.

    a list of current w3c recommendations and other technical documents can be found at http://www.w3.org/tr/.

    table of contents
    1.introduction 
      1.editorial and conformance conventions 
      2.design philosophy 
      3.versions, namespaces uris, and identifiers 
      4.acknowledgements 
    2.encryption overview and examples 
      1.encryption granularity 
        ◇encrypting an xml element 
        ◇encrypting xml element content (elements) 
        ◇encrypting xml element content (character data) 
        ◇encrypting arbitrary data and xml documents 
        ◇super-encryption: encrypting encrypteddata 
      2.encrypteddata and encryptedkey usage 
        ◇encrypteddata with symmetric key (keyname) 
        ◇encryptedkey (referencelist, ds:retrievalmethod,carriedkeyname)

    3.encryption syntax 
      1.the encryptedtype element 
      2.the encryptionmethod element 
      3.the cipherdata element 
        ◇the cipherreference element 
      4.the encrypteddata element 
      5.extensions to ds:keyinfo element 
        ◇the encryptedkey element 
        ◇the ds:retrievalmethod element 
      6.the referencelist element 
      7.the encryptionproperties element 
    4.processing rules 
      1.encryption 
      2.decryption 
      3.encrypting xml 
        ◇a decrypt implementation (non-normative) 
        ◇a decrypt and replace implementation (non-normative) 
        ◇serializing xml (non-normative) 
        ◇text wrapping (non-normative) 
    5.algorithms 
      1.algorithm identifiers and implementation requirements 
      2.block encryption algorithms 
      3.stream encryption algorithms 
      4.key transport 
      5.key agreement 
      6.symmetric key wrap 
      7.message digest 
      8.message authentication 
      9.canonicalization 
    6.security considerations 
      1.relationship to xml digital signatures 
      2.information revealed 
      3.nonce and iv (initialization value or vector) 
      4.denial of service 
      5.unsafe content 
    7.conformance 
    8.xml encryption media type 
      1.introduction 
      2.application/xenc+xml registration 
    9.schema and valid examples 
    10.references 

    --------------------------------------------------------------------------------

    1 introduction
    this document specifies a process for encrypting data and representing the result in xml. the data may be arbitrary data (including an xml document), an xml element, or xml element content. the result of encrypting data is an xml encryption encrypteddata element which contains (via one of its children's content) or identifies (via a uri reference) the cipher data.

    when encrypting an xml element or element content the encrypteddata element replaces the element or content (respectively) in the encrypted version of the xml document.

    when encrypting arbitrary data (including entire xml documents), the encrypteddata element may become the root of a new xml document or become a child element in an application-chosen xml document.

    1.1 editorial and conformance conventions
    this specification uses xml schemas [xml-schema] to describe the content model.

    the key words "must", "must not", "required", "shall", "shall not", "should", "should not", "recommended", "may", and "optional" in this specification are to be interpreted as described in rfc2119 [keywords]:
"they must only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmissions)"

    consequently, we use these capitalized keywords to unambiguously specify requirements over protocol and application features and behavior that affect the interoperability and security of implementations. these key words are not used (capitalized) to describe xml grammar; schema definitions unambiguously describe such requirements and we wish to reserve the prominence of these terms for the natural language descriptions of protocols and features. for instance, an xml attribute might be described as being "optional." compliance with the xml-namespace specification [xml-ns] is described as "required."

    1.2 design philosophy
    the design philosophy and requirements of this specification (including the limitations related to instance validity) are addressed in the xml encryption requirements [encreq].

    1.3 versions, namespaces, uris, and identifiers
    no provision is made for an explicit version number in this syntax. if a future version is needed, it will use a different namespace. the experimental xml namespace [xml-ns] uri that must be used by implementations of this (dated) specification is:
xmlns:xenc='http://www.w3.org/2001/04/xmlenc#'
    this namespace is also used as the prefix for algorithm identifiers used by this specification. while applications must support xml and xml namespaces, the use of internal entities [xml, section 4.2.1], the "xenc" xml namespace prefix [xml-ns, section 2] and defaulting/scoping conventions are optional; we use these facilities to provide compact and readable examples. additionally, the entity &xenc; is defined so as to provide short-hand identifiers for uris defined in this specification. for example "&xenc;element" corresponds to "http://www.w3.org/2001/04/xmlenc#element".

    this specification makes use of the xml signature [xml-dsig] namespace and schema definitions
xmlns:ds='http://www.w3.org/2000/09/xmldsig#'
    uris [uri] must abide by the [xml-schema] anyuri type definition and the [xml-dsig, 4.3.3.1 the uri attribute] specification (i.e., permitted characters, character escaping, scheme support, etc.).

    1.4 acknowledgements
    the contributions of the following working group members to this specification are gratefully acknowledged in accordance with the contributor policies and the active wg roster.
    ◇joseph ashwood 
    ◇simon blake-wilson, certicom 
    ◇frank d. cavallito, bea systems 
    ◇eric cohen, pricewaterhousecoopers 
    ◇blair dillaway, microsoft (author) 
    ◇blake dournaee, rsa security 
    ◇donald eastlake, motorola (editor) 
    ◇barb fox, microsoft 
    ◇christian geuer-pollmann, university of siegen 
    ◇tom gindin, ibm 
    ◇jiandong guo, phaos 
    ◇phillip hallam-baker, verisign 
    ◇amir herzberg, newgenpay 
    ◇merlin hughes, baltimore 
    ◇frederick hirsch 
    ◇maryann hondo, ibm 
    ◇takeshi imamura, ibm (author) 
    ◇mike just, entrust, inc. 
    ◇brian lamacchia, microsoft 
    ◇hiroshi maruyama, ibm 
    ◇john messing, law-on-line 
    ◇shivaram mysore, sun microsystems 
    ◇thane plambeck, verisign 
    ◇joseph reagle, w3c (chair, editor) 
    ◇aleksey sanin 
    ◇jim schaad, soaring hawk consulting 
    ◇ed simon, xmlsec (author) 
    ◇daniel toth, ford 
    ◇yongge wang, certicom 
    ◇steve wiley, myproof 
    additionally, we thank the following for their comments during and subsequent to last call:
    ◇martin dürst, w3c 
    ◇dan lanz, zolera 
    ◇susan lesch, w3c 
    ◇david orchard, bea systems 
    ◇ronald rivest, mit 
    

    2 encryption overview and examples (non-normative)
    this section provides an overview and examples of xml encryption syntax. the formal syntax is found in encryption syntax (section 3); the specific processing is given in processing rules (section 4).

    expressed in shorthand form, the encrypteddata element has the following structure (where "?" denotes zero or one occurrence; "+" denotes one or more occurrences; "*" denotes zero or more occurrences; and the empty element tag means the element must be empty ):
    

    <encrypteddata id? type? mimetype? encoding?>
    <encryptionmethod/>?
    <ds:keyinfo>
    <encryptedkey>?
    <agreementmethod>?
    <ds:keyname>?
    <ds:retrievalmethod>?
    <ds:*>?
    </ds:keyinfo>?
    <cipherdata>
    <ciphervalue>?
    <cipherreference uri?>?
    </cipherdata>
    <encryptionproperties>?
    </encrypteddata>
    the cipherdata element envelopes or references the raw encrypted data. if enveloping, the raw encrypted data is the ciphervalue element's content; if referencing, the cipherreference element's uri attribute points to the location of the raw encrypted data

    2.1 encryption granularity
    consider the following fictitious payment information, which includes identification information and information appropriate to a payment method (e.g., credit card, money transfer, or electronic check):
    

    <?xml version='1.0'?>
    <paymentinfo xmlns='http://example.org/paymentv2'>
    <name>john smith</name>
    <creditcard limit='5,000' currency='usd'>
    <number>4019 2445 0277 5567</number>
    <issuer>example bank</issuer>
    <expiration>04/02</expiration>
    </creditcard>
    </paymentinfo>
    this markup represents that john smith is using his credit card with a limit of $5,000usd.

    2.1.1 encrypting an xml element
    smith's credit card number is sensitive information! if the application wishes to keep that information confidential, it can encrypt the creditcard element:
    

    <?xml version='1.0'?>
    <paymentinfo xmlns='http://example.org/paymentv2'>
    <name>john smith</name>
    <encrypteddata type='http://www.w3.org/2001/04/xmlenc#element'
    xmlns='http://www.w3.org/2001/04/xmlenc#'>
    <cipherdata>
    <ciphervalue>a23b45c56</ciphervalue>
    </cipherdata>
    </encrypteddata>
    </paymentinfo>
    by encrypting the entire creditcard element from its start to end tags, the identity of the element itself is hidden. (an eavesdropper doesn't know whether he used a credit card or money transfer.) the cipherdata element contains the encrypted serialization of the creditcard element.

    2.1.2 encrypting xml element content (elements)
    as an alternative scenario, it may be useful for intermediate agents to know that john used a credit card with a particular limit, but not the card's number, issuer, and expiration date. in this case, the content (character data or children elements) of the creditcard element is encrypted:

    <?xml version='1.0'?> 
    <paymentinfo xmlns='http://example.org/paymentv2'>
    <name>john smith</name>
    <creditcard limit='5,000' currency='usd'>
    <encrypteddata xmlns='http://www.w3.org/2001/04/xmlenc#'
    type='http://www.w3.org/2001/04/xmlenc#content'>
    <cipherdata>
    <ciphervalue>a23b45c56</ciphervalue>
    </cipherdata>
    </encrypteddata>
    </creditcard>
    </paymentinfo>
    2.1.3 encrypting xml element content (character data)
    or, consider the scenario in which all the information except the actual credit card number can be in the clear, including the fact that the number element exists:

    <?xml version='1.0'?> 
    <paymentinfo xmlns='http://example.org/paymentv2'>
    <name>john smith</name>
    <creditcard limit='5,000' currency='usd'>
    <number>
    <encrypteddata xmlns='http://www.w3.org/2001/04/xmlenc#'
    type='http://www.w3.org/2001/04/xmlenc#content'>
    <cipherdata>
    <ciphervalue>a23b45c56</ciphervalue>
    </cipherdata>
    </encrypteddata>
    </number>
    <issuer>example bank</issuer>
    <expiration>04/02</expiration>
    </creditcard>
    </paymentinfo>
    both creditcard and number are in the clear, but the character data content of number is encrypted.

    2.1.4 encrypting arbitrary data and xml documents
    if the application scenario requires all of the information to be encrypted, the whole document is encrypted as an octet sequence. this applies to arbitrary data including xml documents.

    <?xml version='1.0'?> 
    <encrypteddata xmlns='http://www.w3.org/2001/04/xmlenc#'
    mimetype='text/xml'>
    <cipherdata>
    <ciphervalue>a23b45c56</ciphervalue>
    </cipherdata>
    </encrypteddata>
    

    2.1.5 super-encryption: encrypting encrypteddata
    an xml document may contain zero or more encrypteddata elements. encrypteddata cannot be the parent or child of another encrypteddata element. however, the actual data encrypted can be anything, including encrypteddata and encryptedkey elements (i.e., super-encryption). during super-encryption of an encrypteddata or encryptedkey element, one must encrypt the entire element. encrypting only the content of these elements, or encrypting selected child elements is an invalid instance under the provided schema.
    for example, consider the following:

    <pay:paymentinfo xmlns:pay='http://example.org/paymentv2'>
    <encrypteddata id='ed1' xmlns='http://www.w3.org/2001/04/xmlenc#'
    type='http://www.w3.org/2001/04/xmlenc#element'>
    <cipherdata>
    <ciphervalue>originalencrypteddata</ciphervalue>
    </cipherdata>
    </encrypteddata>
    </pay:paymentinfo>
    a valid super-encryption of "//xenc:encrypteddata[@id='ed1']" would be:

    <pay:paymentinfo xmlns:pay='http://example.org/paymentv2'>
    <encrypteddata id='ed2' xmlns='http://www.w3.org/2001/04/xmlenc#'
    type='http://www.w3.org/2001/04/xmlenc#element'>
    <cipherdata>
    <ciphervalue>newencrypteddata</ciphervalue>
    </cipherdata>
    </encrypteddata>
    </pay:paymentinfo>
    where the ciphervalue content of 'newencrypteddata' is the base64 encoding of the encrypted octet sequence resulting from encrypting the encrypteddata element with id='ed1'.

    2.2 encrypteddata and encryptedkey usage
    2.2.1 encrypteddata with symmetric key (keyname)
    [s1] <encrypteddata xmlns='http://www.w3.org/2001/04/xmlenc#'
    type='http://www.w3.org/2001/04/xmlenc#element'/>
    [s2] <encryptionmethod
    algorithm='http://www.w3.org/2001/04/xmlenc#tripledes-cbc'/>
    [s3] <ds:keyinfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
    [s4] <ds:keyname>john smith</ds:keyname>
    [s5] </ds:keyinfo>
    [s6] <cipherdata><ciphervalue>deadbeef</ciphervalue></cipherdata>
    [s7] </encrypteddata>
    [s1] the type of data encrypted may be represented as an attribute value to aid in decryption and subsequent processing. in this case, the data encrypted was an 'element'. other alternatives include 'content' of an element, or an external octet sequence which can also be identified via the mimetype and encoding attributes.

    [s2] this (3des cbc) is a symmetric key cipher.

    [s4] the symmetric key has an associated name "john smith".

    [s6] cipherdata contains a ciphervalue, which is a base64 encoded octet sequence. alternately, it could contain a cipherreference, which is a uri reference along with transforms necessary to obtain the encrypted data as an octet sequence

    2.2.2 encryptedkey (referencelist, ds:retrievalmethod, carriedkeyname)
    the following encrypteddata structure is very similar to the one above, except this time the key is referenced using a ds:retrievalmethod:

    [t01] <encrypteddata id='ed' 
    xmlns='http://www.w3.org/2001/04/xmlenc#'>
    [t02] <encryptionmethod 
    algorithm='http://www.w3.org/2001/04/xmlenc#aes128-cbc'/>
    [t03] <ds:keyinfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
    [t04] <ds:retrievalmethod uri='#ek'
    type="http://www.w3.org/2001/04/xmlenc#encryptedkey"/>
    [t05] <ds:keyname>sally doe</ds:keyname>
    [t06] </ds:keyinfo>
    [t07] <cipherdata><ciphervalue>deadbeef</ciphervalue></cipherdata>
    [t08] </encrypteddata>
    [t02] this (aes-128-cbc) is a symmetric key cipher.

    [t04] ds:retrievalmethod is used to indicate the location of a key with type &xenc;encryptedkey. the (aes) key is located at '#ek'.

    [t05] ds:keyname provides an alternative method of identifying the key needed to decrypt the cipherdata. either or both the ds:keyname and ds:keyretrievalmethod could be used to identify the same key.

    within the same xml document, there existed an encryptedkey structure that was referenced within [t04]:

    [t09] <encryptedkey id='ek' xmlns='http://www.w3.org/2001/04/xmlenc#'>
    [t10] <encryptionmethod 
    algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
    [t11] <ds:keyinfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
    [t12] <ds:keyname>john smith</ds:keyname>
    [t13] </ds:keyinfo>
    [t14] <cipherdata><ciphervalue>xyzabc</ciphervalue></cipherdata>
    [t15] <referencelist>
    [t16] <datareference uri='#ed'/>
    [t17] </referencelist>
    [t18] <carriedkeyname>sally doe</carriedkeyname>
    [t19] </encryptedkey>
    [t09] the encryptedkey element is similar to the encrypteddata element except that the data encrypted is always a key value.

    [t10] the encryptionmethod is the rsa public key algorithm.

    [t12] ds:keyname of "john smith" is a property of the key necessary for decrypting (using rsa) the cipherdata.

    [t14] the cipherdata's ciphervalue is an octet sequence that is processed (serialized, encrypted, and encoded) by a referring encrypted object's encryptionmethod. (note, an encryptedkey's encryptionmethod is the algorithm used to encrypt these octets and does not speak about what type of octets they are.)

    [t15-17] a referencelist identifies the encrypted objects (datareference and keyreference) encrypted with this key. the referencelist contains a list of references to data encrypted by the symmetric key carried within this structure.

    [t18] the carriedkeyname element is used to identify the encrypted key value which may be referenced by the keyname element in ds:keyinfo. (since id attribute values must be unique to a document,carriedkeyname can indicate that several encryptedkey structures contain the same key value encrypted for different recipients.)

    3 encryption syntax
    this section provides a detailed description of the syntax and features for xml encryption. features described in this section must be implemented unless otherwise noted. the syntax is defined via [xml-schema] with the following xml preamble, declaration, internal entity, and import:

    3.1 the encryptedtype element
    encryptedtype is the abstract type from which encrypteddata and encryptedkey are derived. while these two latter element types are very similar with respect to their content models, a syntactical distinction is useful to processing. implementation must generate laxly schema valid [xml-schema] encrypteddata or encryptedkey as specified by the subsequent schema declarations. (note the laxly schema valid generation means that the content permitted by xsd:any need not be valid.) implementations should create these xml structures (encryptedtype elements and their descendents/content) in normalization form c [nfc, nfc-corrigendum].

    encryptionmethod is an optional element that describes the encryption algorithm applied to the cipher data. if the element is absent, the encryption algorithm must be known by the recipient or the decryption will fail.

    ds:keyinfo is an optional element, defined by [xml-dsig], that carries information about the key used to encrypt the data. subsequent sections of this specification define new elements that may appear as children of ds:keyinfo.

    cipherdata is a mandatory element that contains the ciphervalue or cipherreference with the encrypted data.

    encryptionproperties can contain additional information concerning the generation of the encryptedtype (e.g., date/time stamp).

    id is an optional attribute providing for the standard method of assigning a string id to the element within the document context.

    type is an optional attribute identifying type information about the plaintext form of the encrypted content. while optional, this specification takes advantage of it for mandatory processing described in processing rules: decryption (section 4.2). if the encrypteddata element contains data of type 'element' or element 'content', and replaces that data in an xml document context, it is strongly recommended the type attribute be provided. without this information, the decryptor will be unable to automatically restore the xml document to its original cleartext form.

    mimetype is an optional (advisory) attribute which describes the media type of the data which has been encrypted. the value of this attribute is a string with values defined by [mime]. for example, if the data that is encrypted is a base64 encoded png, the transfer encoding may be specified as 'http://www.w3.org/2000/09/xmldsig#base64' and the mimetype as 'image/png'. this attribute is purely advisory; no validation of the mimetype information is required and it does not indicate the encryption application must do any additional processing. note, this information may not be necessary if it is already bound to the identifier in the type attribute. for example, the element and content types defined in this specification are always utf-8 encoded text.

    3.2 the encryptionmethod element
    encryptionmethod is an optional element that describes the encryption algorithm applied to the cipher data. if the element is absent, the encryption algorithm must be known by the recipient or the decryption will fail.

    the permitted child elements of the encryptionmethod are determined by the specific value of the algorithm attribute uri, and the keysize child element is always permitted. for example, the rsa-oaep algorithm (section 5.4.2) uses the ds:digestmethod and oaepparams elements. (we rely upon the any schema construct because it is not possible to specify element content based on the value of an attribute.)

    the presence of any child element under encryptionmethod which is not permitted by the algorithm or the presence of a keysize child inconsistent with the algorithm must be treated as an error. (all algorithm uris specified in this document imply a key size but this is not true in general. most popular stream cipher algorithms take variable size keys.)

    3.3 the cipherdata element
    the cipherdata is a mandatory element that provides the encrypted data. it must either contain the encrypted octet sequence as base64 encoded text of the ciphervalue element, or provide a reference to an external location containing the encrypted octet sequence via the cipherreference element.

    3.3.1 the cipherreference element
    if ciphervalue is not supplied directly, the cipherreference identifies a source which, when processed, yields the encrypted octet sequence.

    the actual value is obtained as follows. the cipherreference uri contains an identifier that is dereferenced. should the cipherreference element contain an optional sequence of transforms, the data resulting from dereferencing the uri is transformed as specified so as to yield the intended cipher value. for example, if the value is base64 encoded within an xml document; the transforms could specify an xpath expression followed by a base64 decoding so as to extract the octets.

    the syntax of the uri and transforms is similar to that of [xml-dsig]. however, there is a difference between signature and encryption processing. in [xml-dsig] both generation and validation processing start with the same source data and perform that transform in the same order. in encryption, the decryptor has only the cipher data and the specified transforms are enumerated for the decryptor, in the order necessary to obtain the octets. consequently, because it has different semantics transforms is in the &xenc; namespace.

    for example, if the relevant cipher value is captured within a ciphervalue element within a different xml document, the cipherreference might look as follows:
    <cipherreference uri="http://www.example.com/ciphervalues.xml">
    <transforms>
    <ds:transform 
    algorithm="http://www.w3.org/tr/1999/rec-xpath-19991116">
    <ds:xpath xmlns:rep="http://www.example.org/repository">
    self::text()[parent::rep:ciphervalue[@id="example1"]]
    </ds:xpath>
    </ds:transform>
    <ds:transform algorithm="http://www.w3.org/2000/09/xmldsig#base64"/>
    </transforms>
    </cipherreference>
    implementations must support the cipherreference feature and the same uri encoding, dereferencing, scheme, and http response codes as that of [xml-dsig]. the transform feature and particular transform algorithms are optional.

    3.4 the encrypteddata element
    the encrypteddata element is the core element in the syntax. not only does its cipherdata child contain the encrypted data, but it's also the element that replaces the encrypted element, or serves as the new document root.

    3.5 extensions to ds:keyinfo element
    there are three ways that the keying material needed to decrypt cipherdata can be provided:
    1.the encrypteddata or encryptedkey element specify the associated keying material via a child of ds:keyinfo. all of the child elements of ds:keyinfo specified in [xml-dsig] may be used as qualified: 
      ◇support for ds:keyvalue is optional and may be used to transport public keys, such as diffie-hellman key values (section 5.5.1). (including the plaintext decryption key, whether a private key or a secret key, is obviously not recommended.) 
      ◇support of ds:keyname to refer to an encryptedkey carriedkeyname is recommended. 
      ◇support for same document ds:retrievalmethod is required. 
    in addition, we provide two additional child elements: applications must support encryptedkey (section 3.5.1) and may support agreementmethod (section 5.5).

    2.a detached (not inside ds:keyinfo) encryptedkey element can specify the encrypteddata or encryptedkey to which its decrypted key will apply via a datareference or keyreference (section 3.6). 
    3.the keying material can be determined by the recipient by application context and thus need not be explicitly mentioned in the transmitted xml. 
    

    3.5.1 the encryptedkey element
    identifer 
    type="http://www.w3.org/2001/04/xmlenc#encryptedkey" 
    (this can be used within a ds:retrievalmethod element to identify the referent's type.)

    the encryptedkey element is used to transport encryption keys from the originator to a known recipient(s). it may be used as a stand-alone xml document, be placed within an application document, or appear inside an encrypteddata element as a child of a ds:keyinfo element. the key value is always encrypted to the recipient(s). when encryptedkey is decrypted the resulting octets are made available to the encryptionmethod algorithm without any additional processing.

    referencelist is an optional element containing pointers to data and keys encrypted using this key. the reference list may contain multiple references to encryptedkey and encrypteddata elements. this is done using keyreference and datareference elements respectively. these are defined below.

    carriedkeyname is an optional element for associating a user readable name with the key value. this may then be used to reference the key using the ds:keyname element within ds:keyinfo. the same carriedkeyname label, unlike an id type, may occur multiple times within a single document. the value of the key is to be the same in all encryptedkey elements identified with the same carriedkeyname label within a single xml document. note that because whitespace is significant in the value of the ds:keyname element, whitespace is also significant in the value of the carriedkeyname element.

    recipient is an optional attribute that contains a hint as to which recipient this encrypted key value is intended for. its contents are application dependent.

    the type attribute inheritted from encryptedtype can be used to further specify the type of the encrypted key if the encryptionmethod algorithm does not define a unambiguous encoding/representation. (note, all the algorithms in this specification have an unambigous representation for their associated key structures.)

    3.5.2 the ds:retrievalmethod element
    the ds:retrievalmethod [xml-dsig]with a type of 'http://www.w3.org/2001/04/xmlenc#encryptedkey' provides a way to express a link to an encryptedkey element containing the key needed to decrypt the cipherdata associated with an encrypteddata or encryptedkey element. the ds:retrievalmethod with this type is always a child of the ds:keyinfo element and may appear multiple times. if there is more than one instance of a ds:retrievalmethod in a ds:keyinfo of this type, then the encryptedkey objects referred to must contain the same key value, possibly encrypted in different ways or for different recipients.

    3.6 the referencelist element
    referencelist is an element that contains pointers from a key value of an encryptedkey to items encrypted by that key value (encrypteddata or encryptedkey elements).

    datareference elements are used to refer to encrypteddata elements that were encrypted using the key defined in the enclosing encryptedkey element. multiple datareference elements can occur if multiple encrypteddata elements exist that are encrypted by the same key.

    keyreference elements are used to refer to encryptedkey elements that were encrypted using the key defined in the enclosing encryptedkey element. multiple keyreference elements can occur if multiple encryptedkey elements exist that are encrypted by the same key.

    for both types of references one may optionally specify child elements to aid the recipient in retrieving the encryptedkey and/or encrypteddata elements. these could include information such as xpath transforms, decompression transforms, or information on how to retrieve the elements from a document storage facility. for example:

    <referencelist>
    <datareference uri="#invoice34">
    <ds:transforms>
    <ds:transform algorithm="http://www.w3.org/tr/1999/rec-xpath-19991116">
    <ds:xpath xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
    self::xenc:encrypteddata[@id="example1"]
    </ds:xpath>
    </ds:transform>
    </ds:transforms>
    </datareference>
    </referencelist>

    3.7 the encryptionproperties element
    identifier 
    type="http://www.w3.org/2001/04/xmlenc#encryptionproperties" 
    (this can be used within a ds:reference element to identify the referent's type.)

    additional information items concerning the generation of the encrypteddata or encryptedkey can be placed in an encryptionproperty element (e.g., date/time stamp or the serial number of cryptographic hardware used during encryption). the target attribute identifies the encryptedtype structure being described. anyattribute permits the inclusion of attributes from the xml namespace to be included (i.e., xml:space, xml:lang, and xml:base).

    4 processing rules
    this section describes the operations to be performed as part of encryption and decryption processing by implementations of this specification. the conformance requirements are specified over the following roles:
    application 
    the application which makes request of an xml encryption implementation via the provision of data and parameters necessary for its processing. 
    encryptor 
    an xml encryption implementation with the role of encrypting data. 
    decryptor 
    an xml encryption implementation with the role of decrypting data. 

    4.1 encryption
    for each data item to be encrypted as an encrypteddata or encryptedkey (elements derived from encryptedtype), the encryptor must:
    1.select the algorithm (and parameters) to be used in encrypting this data. 
    2.obtain and (optionally) represent the key. 
      if the key is to be identified (via naming, uri, or included in a child element), construct the ds:keyinfo as  approriate (e.g., ds:keyname, ds:keyvalue, ds:retrievalmethod, etc.) 
      if the key itself is to be encrypted, construct an encryptedkey element by recursively applying this encryption process. the result may then be a child of ds:keyinfo, or it may exist elsewhere and may be identified in the preceding step. 
    3.encrypt the data 
      ◇if the data is an 'element' [xml, section 3] or element 'content' [xml, section 3.1], obtain the octets by serializing the data in utf-8 as specified in [xml]. (the application must provide xml data in [nfc].) serialization may be done by the encryptor. if the encryptor does not serialize, then the application must perform the serialization. 
      ◇if the data is of any other type that is not already octets, the application must serialize it as octets. 
encrypt the octets using the algorithm and key from steps 1 and 2. 
unless the decryptor will implicitly know the type of the encrypted data, the encryptor should provide the type for representation. 
      ◇the definition of this type as bound to an identifier specifies how to obtain and interpret the plaintext octets after decryption. for example, the idenifier could indicate that the data is an instance of another application (e.g., some xml compression application) that must be further processed. or, if the data is a simple octet sequence it may be described with the mimetype and encoding attributes. for example, the data might be an xml document (mimetype="text/xml"), sequence of characters (mimetype="text/plain"), or binary image data (mimetype="image/png").

    4.build the encryptedtype (encrypteddata or encryptedkey) structure: 
    an encryptedtype structure represents all of the information previously discussed including the type of the encrypted data, encryption algorithm, parameters, key, type of the encrypted data, etc.
      ◇if the encrypted octet sequence obtained in step 3 is to be stored in the cipherdata element within the encryptedtype, then the encrypted octet sequence is base64 encoded and inserted as the content of a ciphervalue element. 
      ◇if the encrypted octet sequence is to be stored externally to the encryptedtype structure, then store or return the encrypted octet sequence, and represent the uri and transforms (if any) required for the decryptor to retrieve the encrypted octet sequence within a cipherreference element. 
    5.process encrypteddata 
      ◇if the type of the encrypted data is 'element' or element 'content', then the encryptor must be able to return the encrypteddata element to the application. the application may use this as the top-level element in a new xml document or insert it into another xml document, which may require a re-encoding. 
        the encryptor should be able to replace the unencrypted 'element' or 'content' with the encrypteddata element. when an application requires an xml element or content to be replaced, it supplies the xml document context in addition to identifying the element or content to be replaced. the encryptor removes the identified element or content and inserts the encrypteddata element in its place.

        (note: if the type is "content" the document resulting from decryption will not be well-formed if (a) the original plaintext was not well-formed (e.g., pcdata by itself is not well-formed) and (b) the encrypteddata element was previously the root element of the document)

      ◇if the type of the encrypted data is not 'element' or element 'content', then the encryptor must always return the encrypteddata element to the application. the application may use this as the top-level element in a new xml document or insert it into another xml document, which may require a re-encoding. 
    4.2 decryption
    for each encryptedtype derived element, (i.e., encrypteddata or encryptedkey), to be decrypted, the decryptor must:
    1.process the element to determine the algorithm, parameters and ds:keyinfo element to be used. if some information is omitted, the application must supply it. 
    2.locate the data encryption key according to the ds:keyinfo element, which may contain one or more children elements. these children have no implied processing order. if the data encryption key is encrypted, locate the corresponding key to decrypt it. (this may be a recursive step as the key-encryption key may itself be encrypted.) or, one might retrieve the data encryption key from a local store using the provided attributes or implicit binding. 
    3.decrypt the data contained in the cipherdata element. 

      ◇if a ciphervalue child element is present, then the associated text value is retrieved and base64 decoded so as to obtain the encrypted octet sequence. 
      ◇if a cipherreference child element is present, the uri and transforms (if any) are used to retrieve the encrypted octet sequence. 
      ◇the encrypted octet sequence is decrypted using the algorithm/parameters and key value already determined from steps 1 and 2. 
    4.process decrypted data of type 'element' or element 'content'. 
      ◇the cleartext octet sequence obtained in step 3 is interpreted as utf-8 encoded character data. 
      ◇the decryptor must be able to return the value of type and the utf-8 encoded xml character data. the decryptor is not required to perform validation on the serialized xml. 
      ◇the decryptor should support the ability to replace the encrypteddata element with the decrypted 'element' or element 'content' represented by the utf-8 encoded characters. the decryptor is not required to perform validation on the result of this replacement operation. 
        the application supplies the xml document context and identifies the encrypteddata element being replaced. if the document into which the replacement is occurring is not utf-8, the decryptor must transcode the utf-8 encoded characters into the target encoding.

    5.process decrypted data if type is unspecified or is not 'element' or element 'content'. 
      ◇the cleartext octet sequence obtained in step 3 must be returned to the application for further processing along with the type, mimetype, and encoding attribute values when specified. mimetype and encoding are advisory. the type value is normative as it may contain information necessary for the processing or interpration of the data by the application. 
      ◇note, this step includes processing data decrypted from an encryptedkey. the cleartext octet sequence represents a key value and is used by the application in decrypting other encryptedtype element(s). 
    

    4.3 xml encryption
    encryption and decryption operations are transforms on octets. the application is responsible for the marshalling xml such that it can be serialized into an octet sequence, encrypted, decrypted, and be of use to the recipient.

    for example, if the application wishes to canonicalize its data or encode/compress the data in an xml packaging format, the application needs to marshal the xml accordingly and identify the resulting type via the encrypteddata type attribute. the likelihood of successful decryption and subsequent processing will be dependent on the recipient's support for the given type. also, if the data is intended to be processed both before encryption and after decryption (e.g., xml signature [xml-dsig] validation or an xslt transform) the encrypting application must be careful to preserve information necessary for that process's success.

    for interoperability purposes, the following types must be implemented such that an implementation will be able to take as input and yield as output data matching the production rules 39 and 43 from [xml]:

    element 'http://www.w3.org/2001/04/xmlenc#element' 
    "[39] element ::= emptyelemtag | stag content etag" 
    content 'http://www.w3.org/2001/04/xmlenc#content' 
    "[43] content ::= chardata? ((element | reference | cdsect | pi | comment) chardata?)*" 
    the following sections contain specifications for decrypting, replacing, and serializing xml content (i.e., type  'element' or element 'content') using the [xpath] data model. these sections are non-normative and optional to     implementors of this specification, but they may be normatively referenced by and mandatory to other specifications  that require a consistent processing for applications, such as [xml-dsig-decrypt].

    4.3.1 a decrypt implementation (non-normative)
    where p is the context in which the serialized xml should be parsed (a document node or element node) and o is the octet sequence representing utf-8 encoded characters resulting from step 4.3 in the decryption processing (section 4.2). y is node-set representing the decrypted content obtained by the following steps:
      ◇let c be the parsing context of a child of p, which consists of the following items: 
      ◇prefix and namespace name of each namespace that is in scope for p. 
      ◇name and value of each general entity that is effective for the xml document causing p. 
      ◇wrap the decrypted octet stream o in the context c as specified in text wrapping. 
parse the wrapped octet stream as described in the reference processing model (section 4.3.3.2) of [xml-signature], resulting in a node-set. 
      ◇y is the node-set obtained by removing the root node, the wrapping element node, and its associated set of attribute and namespace nodes from the node-set obtained in step 3. 
    4.3.2 a decrypt and replace implementation (non-normative)
    where x is the [xpath] node set corresponding to an xml document and e is an encrypteddata element node in x.

    1.z is an [xpath] node-set that identical to x except where the element node e is an encrypteddata element type. in which case: 
      ◇decrypt e in the context of its parent node as specified in the decryption implementation (section 4.3.1) yielding y, an [xpath] node set. 
      ◇include y in place of e and its descendants in x. since [xpath] does not define methods of replacing node-sets from different documents, the result must be equivalent to replacing e with the octet stream resulting from its decryption in the serialized form of x and reparsing the document. however, the actual method of performing this operation is left to the implementor. 
    4.3.3 serializing xml (non-normative)
    default namespace considerations
    in encrypting xml (section 4.1, step 3.1), when serializing an xml fragment special care should be taken with respect to default namespaces. if the data will be subsequently decrypted in the context of a parent xml document then serialization can produce elements in the wrong namespace. consider the following fragment of xml:

    <document xmlns="http://example.org/">
    <tobeencrypted xmlns="" />
    </document>
    serialization of the element tobeencrypted fragment via [xml-c14n] would result in the characters "<tobeencrypted></tobeencrypted>" as an octet stream. the resulting encrypted document would be:

    <document xmlns="http://example.org/">
    <encrypteddata xmlns="...">
    <!-- containing the encrypted 
    "<tobeencrypted></tobeencrypted>" -->
    </encrypteddata>
    </document>
    decrypting and replacing the encrypteddata within this document would produce the following incorrect result:

    <document xmlns="http://example.org/">
    <tobeencrypted/>
    </document> 
    this problem arises because most xml serializations assume that the serialized data will be parsed directly in a context where there is no default namespace declaration. consequently, they do not redundantly declare the empty default namespace with an xmlns="". if, however, the serialized data is parsed in a context where a default namespace declaration is in scope (e.g., the parsing context of a a decrypt implementation (section 4.3.1)), then it may affect the interpretation of the serialized data.

    to solve this problem, a canonicalization algorithm may be augmented as follows for use as an xml encryption serializer:

    a default namespace declaration with an empty value (i.e., xmlns="") should be emitted where it would normally be suppressed by the canonicalization algorithm. 
while the result may not be in proper canonical form, this is harmless as the resulting octet stream will not be used directly in a [xml-signature] signature value computation. returning to the preceding example with our new augmentation, the tobeencrypted element would be serialized as follows:

    <tobeencrypted xmlns=""></tobeencrypted>
    when processed in the context of the parent document, this serialized fragment will be parsed and interpreted correctly.

    this augmentation can be retroactively applied to an existing canonicalization implementation by canonicalizing each apex node and its descendants from the node set, inserting xmlns="" at the appropriate points, and concatenating the resulting octet streams.

    xml attribute considerations
    similar attention between the relationship of a fragment and the context into which it is being inserted should be given to the xml:base, xml:lang, and xml:space attributes as mentioned in the security considerations of    [xml-exc-c14n]. for example, if the element:

    <bongo href="example.xml"/>
    is taken from a context and serialized with no xml:base [xml-base] attribute and parsed in the context of the element:

    <baz xml:base="http://example.org/"/>
    the result will be:

   <baz xml:base="http://example.org/"><bongo href="example.xml"/></baz>
   bongo's href is subsequently interpreted as "http://example.org/example.xml". if this is not the correct uri, bongo should have been serialized with its own xml:base attribute.

    unfortunately, the recommendation that an empty value be emitted to divorce the default namespace of the fragment from the context into which it is being inserted can not be made for the attributes xml:base, and xml:space. (error 41 of the xml 1.0 second edition specification errata clarifies that an empty string value of the attribute xml:lang is considered as if, "there is no language information available, just as if xml:lang had not been specified".)the interpretation of an empty value for the xml:base or xml:space attributes is undefined or maintains the contextual value. consequently, applications should ensure (1) fragments that are to be encrypted are not dependent on xml attributes, or (2) if they are dependent and the resulting document is intended to be valid [xml], the fragment's definition permits the presence of the attributes and that the attributes have non-empty values.

    4.3.4 text wrapping (non-normative)
    this section specifies the process for wrapping text in a given parsing context. the process is based on the proposal by richard tobin [tobin] for constructing the infoset [xml-infoset] of an external entity.

    the process consists of the following steps:
    1.if the parsing context contains any general entities, then emit a document type declaration that provides entity declarations. 
    2.emit a dummy element start-tag with namespace declaration attributes declaring all the namespaces in the parsing context. 
    3.emit the text. 
    4.emit a dummy element end-tag. 
    in the above steps, the document type declaration and dummy element tags must be encoded in utf-8.

    consider the following document containing an encrypteddata element:

    <!doctype document [
    <!entity dsig "http://www.w3.org/2000/09/xmldsig#">
    ]>
    <document xmlns="http://example.org/">
    <foo:body xmlns:foo="http://example.org/foo">
    <encrypteddata xmlns="http://www.w3.org/2001/04/xmlenc#"
    type="http://www.w3.org/2001/04/xmlenc#element">
    ...
    </encrypteddata> 
    </foo:body>
    </document>
    if the encrypteddata element is fed is decrypted to the text "<one><foo:two/></one>", then the wrapped form is as follows:

    <!doctype dummy [
    <!entity dsig "http://www.w3.org/2000/09/xmldsig#">
    ]>
    <dummy xmlns="http://example.org/"
    xmlns:foo="http://example.org/foo"><one><foo:two/></one></dummy>

    5. algorithms
    this section discusses algorithms used with the xml encryption specification. entries contain the identifier to be used as the value of the algorithm attribute of the encryptionmethod element or other element representing the role of the algorithm, a reference to the formal specification, definitions for the representation of keys and the results of cryptographic operations where applicable, and general applicability comments.

    5.1 algorithm identifiers and implementation requirements
    all algorithms listed below have implicit parameters depending on their role. for example, the data to be encrypted or decrypted, keying material, and direction of operation (encrypting or decrypting) for encryption algorithms. any explicit additional parameters to an algorithm appear as content elements within the element. such parameter child elements have descriptive element names, which are frequently algorithm specific, and should be in the same namespace as this xml encryption specification, the xml signature specification, or in an algorithm specific namespace. an example of such an explicit parameter could be a nonce (unique quantity) provided to a key agreement algorithm.

    this specification defines a set of algorithms, their uris, and requirements for implementation. levels of requirement specified, such as "required" or "optional", refere to implementation, not use. furthermore, the mechanism is extensible, and alternative algorithms may be used.

    table of algorithms
    the table below lists the categories of algorithms. within each category, a brief name, the level of implementation requirement, and an identifying uri are given for each algorithm.
    block encryption 
    1.required tripledes
      http://www.w3.org/2001/04/xmlenc#tripledes-cbc 
    2.required aes-128
      http://www.w3.org/2001/04/xmlenc#aes128-cbc 
    3.required aes-256
      http://www.w3.org/2001/04/xmlenc#aes256-cbc 
    4.optional aes-192
      http://www.w3.org/2001/04/xmlenc#aes192-cbc 
    stream encryption 
    1.none
      syntax and recommendations are given below to support user specified algorithms. 
    key transport 
    1.required rsa-v1.5
      http://www.w3.org/2001/04/xmlenc#rsa-1_5 
    2.required rsa-oaep
      http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p 
    key agreement 
    1.optional diffie-hellman
      http://www.w3.org/2001/04/xmlenc#dh 
    symmetric key wrap 
    1.required tripledes keywrap
      http://www.w3.org/2001/04/xmlenc#kw-tripledes 
    2.required aes-128 keywrap
      http://www.w3.org/2001/04/xmlenc#kw-aes128 
    3.required aes-256 keywrap
      http://www.w3.org/2001/04/xmlenc#kw-aes256 
    4.optional aes-192 keywrap
      http://www.w3.org/2001/04/xmlenc#kw-aes192 
    message digest 
    1.required sha1
      http://www.w3.org/2000/09/xmldsig#sha1 
    2.recommended sha256
      http://www.w3.org/2001/04/xmlenc#sha256 
    3.optional sha512
      http://www.w3.org/2001/04/xmlenc#sha512 
    4.optional ripemd-160
      http://www.w3.org/2001/04/xmlenc#ripemd160 
    message authentication 
    1.recommended xml digital signature
      http://www.w3.org/2000/09/xmldsig# 
    canonicalization 
    1.optional canonical xml (omits comments)
      http://www.w3.org/tr/2001/rec-xml-c14n-20010315 
    2.optional canonical xml with comments
      http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments 
    3.optional exclusive xml canonicalization (omits comments)
      http://www.w3.org/2001/10/xml-exc-c14n# 
    4.optional exclusive xml canonicalization with comments
      http://www.w3.org/2001/10/xml-exc-c14n#withcomments 
    encoding 
    1.required base64
      http://www.w3.org/2000/09/xmldsig#base64 
    5.2 block encryption algorithms
    block encryption algorithms are designed for encrypting and decrypting data in fixed size, multiple octet blocks. their identifiers appear as the value of the algorithm attributes of encryptionmethod elements that are children of encrypteddata.

    block encryption algorithms take, as implicit arguments, the data to be encrypted or decrypted, the keying material, and their direction of operation. for all of these algorithms specified below, an initialization vector (iv) is required that is encoded with the cipher text. for user specified block encryption algorithms, the iv, if any, could be specified as being with the cipher data, as an algorithm content element, or elsewhere.

    the iv is encoded with and before the cipher text for the algorithms below for ease of availability to the decryption code and to emphasize its association with the cipher text. good cryptographic practice requires that a different iv be used for every encryption.

    padding
    since the data being encrypted is an arbitrary number of octets, it may not be a multiple of the block size. this is solved by padding the plain text up to the block size before encryption and unpadding after decryption. the padding algorithm is to calculate the smallest non-zero number of octets, say n, that must be suffixed to the plain text to bring it up to a multiple of the block size. we will assume the block size is b octets so n is in the range of 1 to b. pad by suffixing the plain text with n-1 arbitrary pad bytes and a final byte whose value is n. on decryption, just take the last byte and, after sanity checking it, strip that many bytes from the end of the decrypted cipher text.

    for example, assume an 8 byte block size and plain text of 0x616263. the padded plain text would then be 0x616263????????05 where the "??" bytes can be any value. similarly, plain text of 0x2122232425262728 would be padded to 0x2122232425262728??????????????08.

    5.2.1 triple des
    identifier: 
    http://www.w3.org/2001/04/xmlenc#tripledes-cbc (required) 
    ansi x9.52 [tripledes] specifies three sequential fips 46-3 [des] operations. the xml encryption tripledes consists of a des encrypt, a des decrypt, and a des encrypt used in the cipher block chaining (cbc) mode with 192 bits of key and a 64 bit initialization vector (iv). of the key bits, the first 64 are used in the first des operation, the second 64 bits in the middle des operation, and the third 64 bits in the last des operation.

    note: each of these 64 bits of key contain 56 effective bits and 8 parity bits. thus there are only 168 operational bits out of the 192 being transported for a tripledes key. (depending on the criterion used for analysis, the effective strength of the key may be thought to be 112 bits (due to meet in the middle attacks) or even less.)

    the resulting cipher text is prefixed by the iv. if included in xml output, it is then base64 encoded. an example tripledes encryptionmethod is as follows:

    <encryptionmethod
    algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
    5.2.2 aes
    identifier: 
    http://www.w3.org/2001/04/xmlenc#aes128-cbc (required) 
    http://www.w3.org/2001/04/xmlenc#aes192-cbc (optional) 
    http://www.w3.org/2001/04/xmlenc#aes256-cbc (required) 
    [aes] is used in the cipher block chaining (cbc) mode with a 128 bit initialization vector (iv). the resulting cipher text is prefixed by the iv. if included in xml output, it is then base64 encoded. an example aes encryptionmethod is as follows:

    <encryptionmethod
    algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
    5.3 stream encryption algorithms
    simple stream encryption algorithms generate, based on the key, a stream of bytes which are xored with the plain text data bytes to produce the cipher text on encryption and with the cipher text bytes to produce plain text on decryption. they are normally used for the encryption of data and are specified by the value of the algorithm attribute of the encryptionmethod child of an encrypteddata element.

    note: it is critical that each simple stream encryption key (or key and initialization vector (iv) if an iv is also used) be used once only. if the same key (or key and iv) is ever used on two messages then, by xoring the two cipher texts, you can obtain the xor of the two plain texts. this is usually very compromising.

    no specific stream encryption algorithms are specified herein but this section is included to provide general guidelines.

    stream algorithms typically use the optional keysize explicit parameter. in cases where the key size is not apparent from the algorithm uri or key source, as in the use of key agreement methods, this parameter sets the key size. if the size of the key to be used is apparent and disagrees with the keysize parameter, an error must be returned. implementation of any stream algorithms is optional. the schema for the keysize parameter is as follows:

    5.4 key transport
    key transport algorithms are public key encryption algorithms especially specified for encrypting and decrypting keys. their identifiers appear as algorithm attributes to encryptionmethod elements that are children of encryptedkey. encryptedkey is in turn the child of a ds:keyinfo element. the type of key being transported, that is to say the algorithm in which it is planned to use the transported key, is given by the algorithm attribute of the encryptionmethod child of the encrypteddata or encryptedkey parent of this ds:keyinfo element.

    (key transport algorithms may optionally be used to encrypt data in which case they appear directly as the algorithm attribute of an encryptionmethod child of an encrypteddata element. because they use public key algorithms directly, key transport algorithms are not efficient for the transport of any amounts of data significantly larger than symmetric keys.)

    the rsa v1.5 key transport algorithm given below are those used in conjunction with tripledes and the cryptographic message syntax (cms) of s/mime [cms-algorithms]. the rsa v2 key transport algorithm given below is that used in conjunction with aes and cms [aes-wrap].

    5.4.1 rsa version 1.5
    identifier: 
    http://www.w3.org/2001/04/xmlenc#rsa-1_5 (required) 
    the rsaes-pkcs1-v1_5 algorithm, specified in rfc 2437 [pkcs1], takes no explicit parameters. an example of an rsa version 1.5 encryptionmethod element is:
    <encryptionmethod
    algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
    the ciphervalue for such an encrypted key is the base64 [mime] encoding of the octet string computed as per rfc 2437 [pkcs1, section 7.2.1: encryption operation]. as specified in the eme-pkcs1-v1_5 function rfc 2437 [pkcs1, section 9.1.2.1], the value input to the key transport function is as follows:
    crypt ( pad ( key ))
    where the padding is of the following special form:
    02 | ps* | 00 | key
    where "|" is concatenation, "02" and "00" are fixed octets of the corresponding hexadecimal value, ps is a string of strong pseudo-random octets [random] at least eight octets long, containing no zero octets, and long enough that the value of the quantity being crypted is one octet shorter than the rsa modulus, and "key" is the key being transported. the key is 192 bits for tripledes and 128, 192, or 256 bits for aes. support of this key transport algorithm for transporting 192 bit keys is mandatory to implement. support of this algorithm for transporting other keys is optional. rsa-oaep is recommended for the transport of aes keys.

    the resulting base64 [mime] string is the value of the child text node of the cipherdata element, e.g.

    <cipherdata> iwijxqjurcxbyocei4qxjwo9kg8d3p9tlwot4
    t0/gyte96639in0fzfy2/rvp+/bmj01earmkzsr5vw3rwopxw=
    </cipherdata>
    5.4.2 rsa-oaep
    identifier: 
    http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p (required) 
    the rsaes-oaep-encrypt algorithm, as specified in rfc 2437 [pkcs1], takes three parameters. the two user specified parameters are a mandatory message digest function and an optional encoding octet string oaepparams. the message digest function is indicated by the algorithm attribute of a child ds:digestmethod element and the mask generation function, the third parameter, is always mgf1 with sha1 (mgf1sha1identifier). both the message digest and mask generation functions are used in the em