xml-encryption

What is xml-encryption?

The xml-encryption npm package provides tools for encrypting and decrypting XML data. It supports various encryption algorithms and allows for the secure handling of XML documents.

What are xml-encryption's main functionalities?

Encrypting XML Data

This feature allows you to encrypt XML data using a specified encryption algorithm and keys. The code sample demonstrates how to encrypt an XML string using RSA and AES256-CBC.

const xmlenc = require('xml-encryption');
const xml = '<root><name>John Doe</name></root>';
const options = { rsa_pub: 'public_key.pem', pem: 'private_key.pem', encryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc' };
xmlenc.encrypt(xml, options, function(err, result) {
  if (err) console.error(err);
  console.log('Encrypted XML:', result);
});

Decrypting XML Data

This feature allows you to decrypt previously encrypted XML data using the appropriate private key. The code sample demonstrates how to decrypt an encrypted XML string.

const xmlenc = require('xml-encryption');
const encryptedXml = '...'; // Encrypted XML string
const options = { key: 'private_key.pem' };
xmlenc.decrypt(encryptedXml, options, function(err, result) {
  if (err) console.error(err);
  console.log('Decrypted XML:', result);
});

Other packages similar to xml-encryption

xml2js

The xml2js package is used for parsing XML to JavaScript objects and vice versa. While it does not provide encryption functionalities, it is useful for handling XML data in JavaScript applications.

xml-crypto

The xml-crypto package provides tools for XML digital signatures and encryption. It offers similar functionalities to xml-encryption but also includes support for XML signatures, making it a more comprehensive solution for XML security.

node-forge

The node-forge package is a comprehensive library for cryptographic operations in JavaScript, including encryption, decryption, and key generation. While it is not specific to XML, it can be used to implement custom XML encryption and decryption solutions.

README

W3C XML Encryption implementation for Node.js (http://www.w3.org/TR/xmlenc-core/)

Node 18+ does not support Triple DES algorithms due to https://github.com/nodejs/node/issues/52017

Usage

npm install xml-encryption

encrypt

var xmlenc = require('xml-encryption');

var options = {
  rsa_pub: fs.readFileSync(__dirname + '/your_rsa.pub'),
  pem: fs.readFileSync(__dirname + '/your_public_cert.pem'),
  encryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc',
  keyEncryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
  keyEncryptionDigest: 'sha1',
  disallowEncryptionWithInsecureAlgorithm: true,
  warnInsecureAlgorithm: true
};

xmlenc.encrypt('content to encrypt', options, function(err, result) {
    console.log(result);
}

Result:

<xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
  <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes-256-cbc" />
    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
      <e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#">
        <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
          <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
        </e:EncryptionMethod>
        <KeyInfo>
          <X509Data><X509Certificate>MIIEDzCCAveg... base64 cert... q3uaLvlAUo=</X509Certificate></X509Data>
        </KeyInfo>
        <e:CipherData>
          <e:CipherValue>sGH0hhzkjmLWYYY0gyQMampDM... encrypted symmetric key ...gewHMbtZafk1MHh9A==</e:CipherValue>
        </e:CipherData>
      </e:EncryptedKey>
    </KeyInfo>
    <xenc:CipherData>
        <xenc:CipherValue>V3Vb1vDl055Lp92zvK..... encrypted content.... kNzP6xTu7/L9EMAeU</xenc:CipherValue>
    </xenc:CipherData>
</xenc:EncryptedData>

decrypt

var options = {
    key: fs.readFileSync(__dirname + '/your_private_key.key'),
    disallowDecryptionWithInsecureAlgorithm: true,
    warnInsecureAlgorithm: true
};

xmlenc.decrypt('<xenc:EncryptedData ..... </xenc:EncryptedData>', options, function(err, result) {
    console.log(result);
}

// result

decrypted content

Supported algorithms

Currently the library supports:

• EncryptedKey to transport symmetric key using:

  • http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
  • http://www.w3.org/2001/04/xmlenc#rsa-1_5 (Insecure Algorithm)

• EncryptedData using:

  • http://www.w3.org/2001/04/xmlenc#aes128-cbc
  • http://www.w3.org/2001/04/xmlenc#aes256-cbc
  • http://www.w3.org/2009/xmlenc11#aes128-gcm
  • http://www.w3.org/2009/xmlenc11#aes256-gcm
  • http://www.w3.org/2001/04/xmlenc#tripledes-cbc (Insecure Algorithm)

Insecure Algorithms can be disabled via disallowEncryptionWithInsecureAlgorithm/disallowDecryptionWithInsecureAlgorithm flags when encrypting/decrypting. This flag is off by default in 0.x versions.

A warning will be piped to stderr using console.warn() by default when the aforementioned algorithms are used. This can be disabled via the warnInsecureAlgorithm flag.

Issue Reporting

If you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

Author

Auth0

License

This project is licensed under the MIT license. See the LICENSE file for more info.

Releases

Release notes may be found under github release page: https://github.com/auth0/node-xml-encryption/releases