UserToken encryption should not be dependent on the endpoint encryption.

[mrsuciu]

Type of issue

• Bug
• Enhancement
• Compliance
• Question
• Help wanted

Current Behavior

Currently the ECC encrypted endpoints only accept UserToken with Ecc encryption and they should be independent.

Expected Behavior

ECC encrypted endpoints should accept UserToken with RSA based encryption.

Steps To Reproduce

No response

Environment

- OS:
- Environment:
- Runtime:
- Nuget Version: OPC UA 1.05 ECC-preview
- Component:
- Server: 
- Client:

Anything else?

No response

[marcschier]

@randy-armstrong what is your opinion? should the stack support mixing security profiles for user token and channel?

[marcschier]

Need to make sure we do RSA/ECC Independent of underlying secure channel certificate/crypto.

Several bugs/things to look at in here:

• Also, If we have no RSA certificate, we cannot advertise RSA user token identity policies, and vice versa.
• For none security we currently hardcode RSA encryption policy.

@randy-armstrong could you add more details and links or other info so when we do this we have proper coverage.

[opcfoundation-org]

The quickest fix:

1. The config file needs to allows any configured security policy/certificate to be used for UserNameTokens with None endpoint. It should be and error if the None endpoint is configured with a Policy when the Server has no matching certificate.

2. The X509CertificateUserToken must allow any SecurityPolicy even if the Server does not have a matching Certificate (RSA user cert with ECC only server). Config needs to allow multiple X509 TokenPolicies to allow for different types of UserCertificates.

[romanett]

This Issue makes no sense to me.

How shall a Client encrypt a User token with an rsa pub Key from server If using an ecc Endepoint with ecc Server cert in the create Session response.

This functionality is also not required in the spec