XML Security WG publishes Candidate Recommendation Drafts for XML Encryption 1.1

The XML Security Working Group has published the "XML Encryption 1.1" Candidate Recommendation. This is a new CR publication which reflects changes since the previous CR publication to address newly publicized chosen-ciphertext attacks against the CBC class of algorithms. Changes include making an authenticated encryption algorithm mandatory to implement (AES-128-GCM), updating the security considerations and adding additional algorithm choices to the RSA-OAEP key transport algorithm set to provide algorithm agility. Additional changes include various editorial improvements. Details of all changes are noted in the status section of the document.

The Working Group also has published a CR draft outlining the use of XML Signature 2.0 transforms in XML Encryption 1.1 - the "XML Encryption 1.1 CipherReference Processing using 2.0 Transforms" Candidate Recommendation.

To address patent disclosures related to the XML Signature 1.1 and XML Encryption 1.1 specifications, the W3C has chartered a Patent Advisory Group.

Learn more about the Security Activity.