title: How do I make WIF use RSA15 when encrypting data using a certificate?
body: <p>I have been working on a WCF service which will return a Base64 encoded string which is, in reality, a full SAML response XML document.  Because this information will be handed off to a vendor, I have to meet their requirements for how the SAML document will look and be encoded.  I am having trouble getting an output which meets their requirements.</p>
  
  <p>I know WCF and WIF together should help me.  I originally built the service using WIF to create the SAML Assertions (token) and other C# code to generate the final SAML document.  All of this works and meets the vendor's requirements except for the &lt;EncryptedData&gt; node of the document.  This section uses AES256 and RSAOAEP but the vendor wants AES128 and RSA15.  Thus, I am hunting for a resolution.  Any help would be greatly appreciated.</p>
  
  <p>Here is a walk through.</p>
  
  <p>The service takes in a GUID which is used to call the database and return fields.  These are then used like so:</p>
  
  <pre><code>DataTable userData = GetDataForUser(userId);
  List&lt;Claim&gt; claims = new List&lt;Claim&gt;()
  {
      new Claim("ClientId", "NameOfClient")
  };
  foreach (DataRow row in userData.Rows)
  {
      string memberId = row["MemberId"].ToString().Trim();
      string firstName = row["FirstName"].ToString().Trim();
      string lastName = row["LastName"].ToString().Trim();
      DateTime dob = Convert.ToDateTime(row["DateOfBirth"], CultureInfo.InvariantCulture);
  
      claims.Add(new Claim("MemberId", memberId));
      claims.Add(new Claim("FirstName", firstName));
      claims.Add(new Claim("LastName", lastName));
      claims.Add(new Claim("DOB", dob.ToString("MM/dd/yyyy")));
  }
  
  return claims;
  </code></pre>
  
  <p>I then create a SecurityTokenDescriptor like this:</p>
  
  <pre><code>SecurityTokenDescriptor descriptor = new SecurityTokenDescriptor();
  </code></pre>
  
  <p>The claims are added to the descriptor like so:</p>
  
  <pre><code>descriptor.Subject = new ClaimsIdentity(claims);
  </code></pre>
  
  <p>The descriptor is instructed to encrypt the token like this:</p>
  
  <pre><code>descriptor.EncryptingCredentials = GetEncryptingCredentials();
  </code></pre>
  
  <p>and the GetEncryptingCredentials() routine looks like this:</p>
  
  <pre><code>private EncryptedKeyEncryptingCredentials GetEncryptingCredentials()
  {
      // Get the Encrypting Certificate
      X509Certificate2 encryptCert = CertificateHelper.FindSingleCertificate(StoreName.TrustedPeople, StoreLocation.LocalMachine, X509FindType.FindBySubjectDistinguishedName, "&lt;&lt;certificate stuff here &gt;&gt;", true);
  
      EncryptedKeyEncryptingCredentials encryptingCreds = new EncryptedKeyEncryptingCredentials(encryptCert);
  
      return encryptingCreds;
   }
  </code></pre>
  
  <p>All of this generates a token which, when written to a file gives me this:</p>
  
  <pre><code>  &lt;EncryptedAssertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
      &lt;xenc:EncryptedData Id="_16584ace-9f3e-4352-9fc9-f6db8b2e925c" Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
        &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /&gt;
        &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#"&gt;
            &lt;e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
            &lt;/e:EncryptionMethod&gt;
            &lt;KeyInfo&gt;
              &lt;o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
                &lt;X509Data&gt;
                  &lt;X509IssuerSerial&gt;
                    &lt;X509IssuerName&gt;&lt;!-- value --&gt;&lt;/X509IssuerName&gt;
                    &lt;X509SerialNumber&gt;&lt;!-- value --&gt;&lt;/X509SerialNumber&gt;
                  &lt;/X509IssuerSerial&gt;
                &lt;/X509Data&gt;
              &lt;/o:SecurityTokenReference&gt;
            &lt;/KeyInfo&gt;
            &lt;e:CipherData&gt;
              &lt;e:CipherValue&gt;&lt;!-- value --&gt;CipherValue&gt;
            &lt;/e:CipherData&gt;
          &lt;/e:EncryptedKey&gt;
        &lt;/KeyInfo&gt;
        &lt;xenc:CipherData&gt;&lt;xenc:CipherValue&gt;&lt;!-- value --&gt;&lt;/xenc:CipherValue&gt;
        &lt;/xenc:CipherData&gt;
      &lt;/xenc:EncryptedData&gt;
    &lt;/EncryptedAssertion&gt;
  </code></pre>
  
  <p>Great, right?  Nope.  The vendor needs the &lt;EncryptedData&gt; section to have the following child node:</p>
  
  <pre><code>&lt;EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/&gt;
  </code></pre>
  
  <p>And they need the &lt;KeyInfo&gt;&lt;EncryptedKey&gt; section to show this:</p>
  
  <pre><code>&lt;EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/&gt;
  </code></pre>
  
  <p>I have tried every combination I can think of within the GetEncryptingCredentials() routine.  Nothing has produced the desired results.  The most promising error message I receive looks like this:</p>
  
  <blockquote>
    <p>ID4178: The EncryptingCredentials
    provided in the
    SecurityTokenDescriptor is for an
    asymmetric key. You must use an
    EncryptedKeyEncryptingCredentials to
    encrypt the token.</p>
  </blockquote>
  
  <p>Anyone have a suggestion?  Don't be afraid to tell me to start all over.  That's all right.  I just need to get this to work.</p>
  
  <p>Thanks in advance.</p>