Welcome to Apache Santuario™

The Project

The Apache Santuario™ project is aimed at providing implementation of the primary security standards for XML:

• XML-Signature Syntax and Processing
• XML Encryption Syntax and Processing.

Two libraries are currently available.

• Apache XML Security for Java: This library includes the standard JSR-105 (Java XML Digital Signature) API,  a mature DOM-based implementation of both XML Signature and XML Encryption, as well as a more recent StAX-based (streaming) XML Signature and XML Encryption implementation.
• Apache XML Security for C++: This library includes a mature Digital Signature and Encryption implementation using a proprietary C++ API on top of the Xerces-C XML Parser's DOM API. It includes a pluggable cryptographic layer, but support for alternatives to OpenSSL are less complete and less mature.

News

June 2020

Version 2.2.0 of the Apache XML Security for Java library has been released. This is a new major release with the following features:

• Added support for RSASSA-PSS with Parameters
• Extensive refactoring and code simplification
• JDK14 officially supported
• Ability to set a security provider when using org.apache.xml.security.signature.XMLSignature
• Added support for customizing how to parse a Inputstream into a DOM Document

This release also includes a fix for CVE-2020-2773 which affected our code base too, but as we do not consider it a vulnerability we won't be issuing our own CVE.

Please see the release notes for more information.

March 2020

Version 2.1.5 of the Apache XML Security for Java library has been released.

Please see the release notes for more information.

November 2018

Version 2.0.2 of the Apache XML Security for C++ has been released.

This patch corrects a bug that can cause crashes in upstream applications. It is similar to, but not the same as, the one that was patched in V2.0.1, and resulted from further review of the code by the project that contributes all of the current manpower to the project. Appreciation is extended to the Shibboleth Project team for this review.

Older News

See here for old news.