Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Web Services / May 2006

Tip: Looking for answers? Try searching our database.

WSE_SmalQuestion

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Hung Ngo - 24 May 2006 02:20 GMT
Hi all,
I'm reading WSE 3.0 documentation and I cann't understand the way WSE 3.0
use to sign and encrypt message.
In document, the MutualCertificate11Assertion sign and encrypt message like
below:
"
SOAP request
Digital Signature
The SOAP message parts specified in the child element of the element are
digitally signed using the client's X509SecurityToken security token.

SOAP request
Encryption
The SOAP message parts specified in the child element of the element are
encrypted using a EncryptedKeyToken security token that is created using the
Web service's X509SecurityToken security token.

SOAP response
Digital Signature
The SOAP message parts specified in the or child elements of the element are
digitally signed using the Web service's X509SecurityToken security token.

SOAP response
Encryption
The SOAP message parts specified in the or child elements of the element are
encrypted using the X509SecurityToken security token that digitally signed
the SOAP request.
"
(source from msdn.microsoft.com)

A thing I don't understand is that why the request from the client is
encrypted by Webservice's X509SecurityToken and then the response is
encrypted by using the X509SecurityToken security token that digitally signed
the SOAP request not by Client's X509SecurityToken.

Thanks in advance,

Hung
Kirk Allen Evans [msft] - 24 May 2006 08:07 GMT
It's almost 3am here, so bear with me if this is fuzzy.

I have struggled with an analogy for this for awhile.  You can think of this
like a phone conversation.  I call you using your phone number, but for us to
talk you have to pick up the phone.  Since I called you, you can look on
caller ID and then call me back... but you can't force me to pick up the
phone, either.

I know, it's a weak analogy.  Let's try a set of doors.

Imagine the front door to my house.  You are fine with telling me how to
lock the door, but there's no way you are giving me the keys to your house to
unlock the door.  And vice-versa, I'd be more than happy to tell you how to
lock the front door to my house, but there's no way I am giving you the key
to unlock it.

You are the client, I am the service in this example.

You want to talk to me securely.  To do so, you will encrypt the message
using my public key.  You can't decrypt the message using my key, I won't
give you my keys (not to my car, my house, or anything else).  But you can
encrypt the message just fine.  In other words, I can tell you how to lock
the door, but since I am the one with the key, I am the only one that can
unlock it.

You can sign the message with your private key and send the public key along
with the message.  When I get the message, I use the public key to re-sign
the message and compare the results... if it matches, I know it has not been
tampered with, and I know it came from you.  It's your signature, I am just
comparing it to the signature I have on file for you.

Now I want to send you a response.  I can't encrypt it with my public key,
because remember that I am not about to give you my key (not to my house, not
to my car).  If I did that, you couldn't unlock it.  I need to encrypt the
message with something that only you can decrypt it with... but what do I
have laying around that could do that?  Oh yeah... you sent me your public
key when you signed the message.  I can use that.  Now I can't decrypt the
response, because I don't have your private key (I am betting you have the
same policy about not handing out the key to your front door).  In other
words, you came to my house and left a note that told me how to lock your
front door.

The whole scheme works because I can't unlock your stuff, and you can't
unlock mine.  

> Hi all,
> I'm reading WSE 3.0 documentation and I cann't understand the way WSE 3.0
[quoted text clipped - 34 lines]
>
> Hung

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.