This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/dk-algorithm-suite in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 243c26e0cc927fa42d8341e32abf3f9317436dd7 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Thu Sep 3 16:47:45 2026 +0100 Enable and fix derived key WS-SecurityPolicy validation in the DOM code --- .../common/crypto/AlgorithmSuiteValidator.java | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java index 7a4230580..d66f91fdd 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java @@ -312,32 +312,38 @@ public class AlgorithmSuiteValidator { } /** - * Check Signature Derived Key length (in bytes) + * Check the Signature Derived Key length. The supplied key length is denominated in + * bytes (the denomination of the wsc:Length element of a DerivedKeyToken), whereas + * the AlgorithmSuite requirement is denominated in bits. */ public void checkSignatureDerivedKeyLength( int derivedKeyLength ) throws WSSecurityException { int requiredKeyLength = algorithmSuite.getSignatureDerivedKeyLength(); - if (requiredKeyLength > 0 && (derivedKeyLength / 8) != requiredKeyLength) { + if (requiredKeyLength > 0 && (derivedKeyLength * 8) != requiredKeyLength) { LOG.warn( - "The signature derived key length of " + derivedKeyLength + " does not match" - + " the requirement of " + requiredKeyLength + "The signature derived key length of " + (derivedKeyLength * 8) + " bits does not match" + + " the requirement of " + requiredKeyLength + " bits" ); + throw new WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY); } } /** - * Check Encryption Derived Key length (in bytes) + * Check the Encryption Derived Key length. The supplied key length is denominated in + * bytes (the denomination of the wsc:Length element of a DerivedKeyToken), whereas + * the AlgorithmSuite requirement is denominated in bits. */ public void checkEncryptionDerivedKeyLength( int derivedKeyLength ) throws WSSecurityException { int requiredKeyLength = algorithmSuite.getEncryptionDerivedKeyLength(); - if (requiredKeyLength > 0 && (derivedKeyLength / 8) != requiredKeyLength) { + if (requiredKeyLength > 0 && (derivedKeyLength * 8) != requiredKeyLength) { LOG.warn( - "The encryption derived key length of " + derivedKeyLength + " does not match" - + " the requirement of " + requiredKeyLength + "The encryption derived key length of " + (derivedKeyLength * 8) + " bits does not match" + + " the requirement of " + requiredKeyLength + " bits" ); + throw new WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY); } }
