Decryption error with MGF

[timlegge]

I am fairly sure I am doing something wrong.

I have the following xml file that I generate with my perl XML::Enc module (so it is possible that I have a problem in the module).

The private key and public keys are at https://metacpan.org/release/TIMLEGGE/XML-Enc-0.13/source/t/sign-private.pem and https://metacpan.org/release/TIMLEGGE/XML-Enc-0.13/source/t/sign-certonly.pem

<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep"><dsig:DigestMethod xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/><xenc:OAEPparams xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">ZW5jcnlwdA==
</xenc:OAEPparams><xenc11:MGF xmlns:xenc11="http://www.w3.org/2009/xmlenc11#" Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha512"/></xenc:EncryptionMethod><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:KeyName xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">mykey</dsig:KeyName></dsig:KeyInfo><xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">lNaotPH/DiJFPwgsVjJZcK7X2F3hGIOlrK7HnvGkMIYC17lBb4YnNyHMQNc2o7ItVGRi/KKmgKmI
k71+jqPw6Exd/Xw46TEwz1F8pqtc38okRGGWHhQjTLLYxQVguAVVdka64QFcAf/42wL3zfxxOpNM
grfb1W5fsHAlm++A4/yeIFtwY+JVHsL3O8WQe3aMddXmCrdO3z0pOxv5iHg6oK1IY5igL3/63eYe
Eqgyw51G1stVXR8K+sL3b0A7i/jk++sUZAxr8APCJG2sVNbTFry4LBAurVsw/HvdtE8aXCyGFf6Z
HCKUhWbMPOwdlOWEmtSQBlRUaPLS6fxsiAJpFMLtf4SVTR5BuBnIjctQrRTMoGYQkWzC7BEckcZl
fdLjN+vnnbTU5NHDEX/u3rQmcw/DOo+Kd1iYsJjBnOoSjsUcLPk192KQvuzjUV3ZukWn6HvCFEuw
4Cg13RFbCsoKN6eBUHW6sQdfgz0KlwOO4p94rp8L9E2HEQmqn+EDI/7d5Bqnqrn4JTLC8ODyRRX1
5mqInmo0CEHBeOGmM0qDWBBVwFgMCt7F3Coe6q76CqPM+ka4SCA1T2OZZHSnKD++P3smf4unkDGM
V9IOdO6EDgfBeDcLlgJkbUaKspaKljTfD4jgQt+QmbA/yU9Fqp0N+Rt1bQwaqOpc94DIXezflFo=
</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></dsig:KeyInfo><xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">8motoi0JfYRSxqwPdiE7+fIDKs3qtz6uDllqXw1AHAofASoW8uwr4yLjU1Y1MCHw6kbWn4RAu+rT
MsFgxWg6Ag==
</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData>

The following command is being used to decrypt:

xmlsec1 --decrypt --privkey-pem:mykey t/sign-private.pem,t/sign-certonly.pem rsa-oaep-mgf1sha512-sha512-aes256-cbc-tmp.xml
which results in the following:

calling xmlsec1 failed: 'func=xmlSecTransformNodeRead:file=transforms.c:line=1324:obj=unknown:subj=xmlSecTransformIdListFindByHref:error=1:xmlsec library function failed:href=http://www.w3.org/2009/xmlenc11#rsa-oaep
func=xmlSecTransformCtxNodeRead:file=transforms.c:line=600:obj=EncryptionMethod:subj=xmlSecTransformNodeRead:error=1:xmlsec library function failed: 
func=xmlSecEncCtxEncDataNodeRead:file=xmlenc.c:line=751:obj=EncryptionMethod:subj=xmlSecTransformCtxNodeRead:error=1:xmlsec library function failed: 
func=xmlSecEncCtxDecryptToBuffer:file=xmlenc.c:line=610:obj=unknown:subj=xmlSecEncCtxEncDataNodeRead:error=1:xmlsec library function failed: 
func=xmlSecKeysMngrGetKey:file=keys.c:line=1256:obj=unknown:subj=xmlSecKeysMngrFindKey:error=1:xmlsec library function failed: 
func=xmlSecEncCtxEncDataNodeRead:file=xmlenc.c:line=788:obj=unknown:subj=unknown:error=45:key is not found:encMethod=aes256-cbc
func=xmlSecEncCtxDecryptToBuffer:file=xmlenc.c:line=610:obj=unknown:subj=xmlSecEncCtxEncDataNodeRead:error=1:xmlsec library function failed: 
func=xmlSecEncCtxDecrypt:file=xmlenc.c:line=536:obj=unknown:subj=xmlSecEncCtxDecryptToBuffer:error=1:xmlsec library function failed: 
Error: failed to decrypt file
Error: failed to decrypt file "rsa-oaep-mgf1sha512-sha512-aes256-cbc-tmp.xml"
'

any ideas why I cannot find the key?

[timlegge]

Never mind - it finally occurred to me to check the version installed. It was xmlsec1 1.2.39 (openssl)

I installed from github and it works fine.

[lsh123]

Yeah, RSA-OAEP was added in 1.3.0 (#623) so 1.2.x branch doesn't have it.