Take a look at the <ds:KeyInfo/> element. It says that default namespace is dsig namespace. Thus, you got <EncryptedKey/> node in dsig namespace which is defenetly wrong. Aleksey