holodeck-b2b/Holodeck-B2B

Add support for Ellipitic Curve w/ brainpool

TheoGoudout opened this issue · 7 comments

TheoGoudout commented

There is an AS4 profile called BDEW (cf. https://www.bundesnetzagentur.de/DE/Beschlusskammern/1_GZ/BK6-GZ/2021/BK6-21-282/Mitteilung02/AS4%20Profil.pdf?__blob=publicationFile&v=1) used for the energy market in Germany. This profile requires the usage of Elliptic Curve with brainpoolP256r1 algorithms (ECDSAwithSHA256, etc.) for signing and encrypting.

I've tried to configure Holodeck B2B in order to use my locally generated EC certificates with no luck so far.

Could you please consider adding support for this class of algorithms. If this is already the case, could you please add an example configuration ? I believe some people could be interested in using your application for this purpose.

Thanks

sfieten commented

Version 6.1.0 should support signing with EC based algorithms, but it does not support EC based encryption as this requires the implementation of the Key Agreement mechanism which is not part of the AS4 an/or WS-Security standards and therefore requires additional development.

We are now working on support for the EC based Diffie Hellman Key Agreement Ephemeral Static Mode mechanism in Holodeck B2B version 7.

ilicalex commented

I am also interested to have this BDEW profile support

ilicalex commented

If my friends and I can contribute to the open source project in order to speed up AS4 BDEW profile support in segment of EC based encryption and implementation of the Key Agreement mechanism, we will be happy to assist

sfieten commented

The SNAPSHOT version in the next branch now includes support for the EC based signing and Diffie-Hellman Key Agreement method for exchanging the symmetric encryption keys.

NOTES:

  1. Issue #124 has not been fixed yet, so you need to build the interfaces, core and ebms3as4 modules first, then file-backend and then the main project again.
  2. This version is still in development and should therefore not be used in a production environment!
  3. To enable the use of Brainpool curves you also need to adjust the jdk.disabled.namedCurves property in java.security and remove the brainpool curves from the list of blocked curves.
RobertArmic commented

@sfieten, is there a possibility for you to provide the binary files for next branch? Or at least for file-backend? Your proposed workaround for circular dependency does not work (file-backend depends on holodeckb2b-ebms3as4 and some other artifacts, building just interfaces module was not enough for me to get it working).

sfieten commented

@RobertArmic, you're right that only buidling the interfaces module isn't enough to be able to build the file back-end project. Also the core and ebms3as4 modules need to be built. I've updated my comment to reflect this.

Regarding binaries; we only provide these for final releases which can be used in production environments. If you however would like to participate in testing of the new features, contact use via the contact form on our website.

ilicalex commented