能否对 SAML 2.0 中的 SAML 属性进行对称加密？
能否对 SAML 2.0 中的 SAML 属性进行对称加密？我们似乎可以做不对称的事情。有什么优点和缺点？
Can you do symmetric encryption on SAML attributes in SAML 2.0? We can seem to do asymmetric. What are pros and cons?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
SAML 2.0 利用 XML 加密（第 5.2.1 节和第 5.2.2 节）。话虽如此，SAML 第 4.2 节2.0 一致性文档指定您必须支持以下内容才能符合 SAML 2.0：
换句话说，SAML 2.0 要求您使用非对称密钥。
因此，“缺点”是，如果您使用 SAML 属性的对称加密，则您不符合 SAML 2.0，这将导致与其他 SAML 2.0 合作伙伴的互操作性问题。但是，这并不意味着您实际上不能选择使用这种类型的加密，只要您的合作伙伴也支持这种加密。
在“优点”方面，对称加密速度更快（据我所知计算强度较小），但我很确定它不值得在合规性方面进行权衡。
SAML 2.0 utilizes XML Encryption (Sect 5.2.1 and 5.2.2). With that said, Sect 4.2 of the SAML 2.0 Conformance docs specifies you must support the following to be SAML 2.0 compliant:
In other words, SAML 2.0 mandates you use asymmetric keys.
So, the "cons" will be that you are not SAML 2.0 compliant if you utilize symmetric encryption of SAML Attributes which will lead to interopability issues with other SAML 2.0 partners. However, that does not mean that you cannot actually choose to use this type of encryption as long as your partner supports this as well.
On the "pros" side, symmetric encryption is faster (less computationally intensive I'm told) but I'm pretty sure it's not worth the trade-off wrt compliance.
请记住，实际上您总是同时使用非对称和对称加密 - 这是安全方面的最佳实践。对称的底层块加密方法（如 Ian 所说：Triple DES、AES 等）。非对称是首选，因为它具有更强的安全性（更大的密钥大小等），并且易于保持私钥的安全（仅需要分发公钥）。然而，由于其性能，它仅用作交换对称密钥的手段。对大量数据进行对称加密是为了提高速度。
在 XML 加密规范中，EncryptedData 元素包含对称加密的数据，而 EncryptedKey 是对称加密/解密密钥，通过非对称加密进行加密。
Keep in mind that in reality you are always using both asymmetric and symmetric encryption - this is best practice in security. The underlying block encryption method that is symmetric (as noted by Ian: Triple DES, AES, etc.). Asymmetric is preferred due to stronger security (larger key sizes, etc.) - and ease of keeping the private keys secure (only the public keys need to be distributed). However due to its performance it's only used as a means to exchange symmetric keys. Symmetric encryption on the bulk of the data is done for speed.
In the XML Encryption spec, EncryptedData element contains symmetrically encrypted data, while EncryptedKey is your symmetric encryption/decryption key, encrypted via asymmetric encryption.
如果您想了解 XML 加密，Don Eastlake 的经典著作《安全 XML：签名和加密的新语法》仍然是最好的。他解释了 XML Enc 和 DSig 设计中的权衡，并提供了有关实现的技巧。自他撰写该书以来的 9 年里，出现了许多关于这些权衡的约定，您可以通过搜索找到它们。
我的同事 Ian 列出了 SAML 2.0 所需的算法，因此您可以在 Eastlake 的书中重点关注这些算法。正如您可能知道的那样，规范中的“必需”意味着如果您将自己限制在这些范围内，那么您将具有互操作性。
最后，Scott 描述的这种技术，生成随机对称密钥，用它加密数据，然后使用接收者的公共加密密钥加密随机对称密钥，通常称为数字信封，在密码学中随处使用，从 SSL密钥管理系统。
If you want to understand XML encryption, Don Eastlake's classic, Secure XML: The New Syntax for Signatures and Encryption, is still the best. He explains the trade-offs in the designs for XML Enc and DSig, and has tips about implementation. In the 9 years since he wrote it, many conventions have arisen about these trade-offs, which you can find via search.
My colleague, Ian, has listed the SAML 2.0 required algorithms, so you can focus on these in Eastlake's book. And as you are probably aware, "required" in a spec means that if you limit yourself to just these, you will be interoperable.
Finally, this technique Scott describes, of generating a random symmetrical key, encrypting the data with it, and then encrypting the random symmetrical key w/ the public encryption key of your recipient is ofter called digital enveloping and is used everywhere in cryptography, from SSL to key management systems.