(ws-wss4j) branch 2_4_x-fixes updated: Enable and fix derived key WS-SecurityPolicy validation in the DOM code (#668)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 2_4_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git


The following commit(s) were added to refs/heads/2_4_x-fixes by this push:
     new 86da0d216 Enable and fix derived key WS-SecurityPolicy validation in 
the DOM code (#668)
86da0d216 is described below

commit 86da0d2167eaae92da7e0186d379328be6e574d3
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Thu Sep 3 17:33:31 2026 +0100

    Enable and fix derived key WS-SecurityPolicy validation in the DOM code 
(#668)
---
 .../common/crypto/AlgorithmSuiteValidator.java     | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git 
a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java
 
b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java
index 714101fa8..d4d5beb59 100644
--- 
a/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java
+++ 
b/ws-security-common/src/main/java/org/apache/wss4j/common/crypto/AlgorithmSuiteValidator.java
@@ -239,32 +239,38 @@ public class AlgorithmSuiteValidator {
     }
 
     /**
-     * Check Signature Derived Key length (in bytes)
+     * Check the Signature Derived Key length. The supplied key length is 
denominated in
+     * bytes (the denomination of the wsc:Length element of a 
DerivedKeyToken), whereas
+     * the AlgorithmSuite requirement is denominated in bits.
      */
     public void checkSignatureDerivedKeyLength(
         int derivedKeyLength
     ) throws WSSecurityException {
         int requiredKeyLength = algorithmSuite.getSignatureDerivedKeyLength();
-        if (requiredKeyLength > 0 && (derivedKeyLength / 8) != 
requiredKeyLength) {
+        if (requiredKeyLength > 0 && (derivedKeyLength * 8) != 
requiredKeyLength) {
             LOG.warn(
-                "The signature derived key length of " + derivedKeyLength + " 
does not match"
-                + " the requirement of " + requiredKeyLength
+                "The signature derived key length of " + (derivedKeyLength * 
8) + " bits does not match"
+                + " the requirement of " + requiredKeyLength + " bits"
             );
+            throw new 
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY);
         }
     }
 
     /**
-     * Check Encryption Derived Key length (in bytes)
+     * Check the Encryption Derived Key length. The supplied key length is 
denominated in
+     * bytes (the denomination of the wsc:Length element of a 
DerivedKeyToken), whereas
+     * the AlgorithmSuite requirement is denominated in bits.
      */
     public void checkEncryptionDerivedKeyLength(
         int derivedKeyLength
     ) throws WSSecurityException {
         int requiredKeyLength = algorithmSuite.getEncryptionDerivedKeyLength();
-        if (requiredKeyLength > 0 && (derivedKeyLength / 8) != 
requiredKeyLength) {
+        if (requiredKeyLength > 0 && (derivedKeyLength * 8) != 
requiredKeyLength) {
             LOG.warn(
-                "The encryption derived key length of " + derivedKeyLength + " 
does not match"
-                + " the requirement of " + requiredKeyLength
+                "The encryption derived key length of " + (derivedKeyLength * 
8) + " bits does not match"
+                + " the requirement of " + requiredKeyLength + " bits"
             );
+            throw new 
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY);
         }
     }