encrypt and sign with WS-Security
Development toolkit for Web Services and XML data bindings for C & C++
Brought to you by:
engelen
Menu
▾
▴
#105 encrypt and sign with WS-Security
Hello,
I am currently evaluating the use of gsoap 2.8.66 with the WS-Security plugin.
I need both Encryption and Signing the Message body.
It is documented, that gsoap only supports first signing and then encryption.
I am facing the problem, that the peer, that I have to interface needs / expects the other order.
So it wants first having encrypted the body, then create the signatures over this encrypted body and some header elements.
Is there a way to change this order in the wsseapi.cpp easily? Or can you give hints, how this could be achieved?
I would be able to test changes and check results on soap message level.
If you are planning to implement this functionality and make the order of enc/sign configurable, information about this would also be appreciated.
Thank you
Meinolf Ludwigt
Hi Robert,
is there any news or idea about this issue? Is it a common issue that the WS-Security standard does not define the order of encrypting and signing and some server are using it differently?
Without passing the TLS layer it would not be possible to use gSOAP for this kind of services.
Best regards,
Massimo
First signing and then encrypting is safe. The reverse is not safe from a security protocol perspective as has been reported by experts on secure messaging protocols. This has been known for some time. Hence signing after encryption should be avoided and is not enabled in WS-Security with gSOAP.