According to the w3c EncryptionMethod element schema the number of parameters (child elements) is unbounded. http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#sec-EncryptionMethod While org.apache.xml.security.encryption.XMLCipher.Factory.EncryptionMethodImpl implementation places into Element only ONE parameter from the encryptionMethodInformation List. org.apache.xml.security.encryption.XMLCipher.Factory.EncryptionMethodImpl { private List encryptionMethodInformation = null; ... Element toElement() { ... if (!encryptionMethodInformation.isEmpty()) { Iterator itr = encryptionMethodInformation.iterator(); result.appendChild((Element) itr.next()); } return (result); } } }
Fixed. Normally I add a test case but this fix seemed very low risk. However, if you have a test case, please send it to me and I will incorporate it.