How EncryptedData Replaces XML Nodes in XML-Enc

This article explains the mechanism by which the EncryptedData element in the XML Encryption (XML-Enc) standard substitutes original plaintext XML nodes. It covers the structural difference between encrypting an entire element versus its contents, the step-by-step serialization and replacement process, and how the target document retains its structural validity post-encryption.

Modes of Replacement

XML Encryption defines two standard ways to replace plaintext with an xenc:EncryptedData element, indicated by the optional Type attribute:

  1. Element Encryption (Type="http://www.w3.org/2001/04/xmlenc#Element"): The entire XML element—including its opening tag, closing tag, attributes, and all child nodes—is removed from the document tree and replaced directly with the <xenc:EncryptedData> element.

  2. Content Encryption (Type="http://www.w3.org/2001/04/xmlenc#Content"): The container element’s tags and attributes remain unchanged in the XML tree, but its inner content (character data and child elements) is removed and replaced by <xenc:EncryptedData>.

The Step-by-Step Replacement Process

The transition from plaintext nodes to an EncryptedData structure follows a strict four-step pipeline:

1. Serialization of the Target Node

The XML parser locates the target node or nodes. The target subtree is serialized into an octet sequence (a byte stream), typically using Canonical XML (C14N) to ensure character encoding and namespace declarations are properly captured.

2. Encryption of the Serialized Octets

The serialized byte stream is encrypted using a symmetric cipher (such as AES-GCM or AES-CBC). The resulting ciphertext represents the raw binary form of the original XML fragment.

3. Construction of the EncryptedData Node

An <xenc:EncryptedData> element is constructed to hold the encrypted payload. A typical structure includes: * CipherData / CipherValue: Contains the Base64-encoded ciphertext. * EncryptionMethod: Identifies the encryption algorithm used. * KeyInfo (Optional): Details the key management data or contains an EncryptedKey element.

4. In-Place Tree Replacement

The DOM (Document Object Model) or XML document tree is updated: * If replacing an Element, the original node is detached, and the newly generated <xenc:EncryptedData> node is inserted at the exact same position in the parent element’s child list. * If replacing Content, all children of the target element are deleted, and the <xenc:EncryptedData> node is appended as the sole child of the target element.

Reversing the Process (Decryption)

During decryption, the recipient reads the <xenc:EncryptedData> element, decrypts the CipherValue back into a UTF-8 octet sequence, and parses this byte sequence back into an XML node or document fragment. The XML parser then replaces the <xenc:EncryptedData> element with the restored plaintext DOM nodes, returning the XML document to its original state.