Webservice digital signature & security question

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

gm0ney - 01 Dec 2004 21:16 GMT

If my webservice is currently secured with a SSL cert,
do I really need to encrypt or use a digital signature
at the soap message level?

Isn't that basically encrypting the encryption. Or I'm totally
missing the boat here?

Just trying to gather answers for implementing Digital Signatures
in our soap transactions, or is the use of an SSL cert sufficient.

Thanks,

Reply to this Message

nealboy - 02 Dec 2004 09:58 GMT

Can SSL security be used in Web Servicves?I think the better way is using of
SOAP extension to sign/verify or encrypt/decrypt soap message.
You can make it by writing code yourself or using of WSE directly.

> If my webservice is currently secured with a SSL cert,
> do I really need to encrypt or use a digital signature
[quoted text clipped - 7 lines]
>
> Thanks,

Reply to this Message

gm0ney - 02 Dec 2004 19:29 GMT

Yes, our webservice is already secured by an SSL cert.

My question, if it wasn't clear, does the use of a digital signature
gain anything?

I can definitly see the pros if not wanting to use SSL or the possible
performace degradation of SSL.

But if already using an SSL cert, why do I need to do the other?

> Can SSL security be used in Web Servicves?I think the better way is
> using of SOAP extension to sign/verify or encrypt/decrypt soap
[quoted text clipped - 10 lines]
>>
>> Thanks,

Reply to this Message

Rory Plaire - 02 Dec 2004 20:47 GMT

gm0ney <gm0ney@night-storm.net> wrote in news:Xns95B389472C220xXxZzZxXxZzZ@
207.46.248.16:

> Yes, our webservice is already secured by an SSL cert.
>
[quoted text clipped - 5 lines]
>
> But if already using an SSL cert, why do I need to do the other?

Hi,

It depends on your needs. The digital signature ensures integrity for the
message, no matter how many points the message passes through, whereas SSL
is only point-to-point. With WSE 2.0 extensions, you can send messages
through untrusted networks securely. If you own both ends and the route in
between, it's probably much less crucial to use WSE security. Nonetheless,
I implement it because it makes the services much more extensible in the
future, since I can redeploy services and change routes without having to
maintain SSL plumbing.

-rory

Reply to this Message

Webservice digital signature & security question

Free Magazines