RE: Signed SOAP messages

[Anne Thomas Manes]

Digital signature is used for authentication, message integrity, and non-repudiation. SSL supports authentication and message confidentiality.   Digital signature is an application-level security measure, which supports end-to-end security. It works regardless of the number of hops between originating sender and ultimate receiver. Digital signature can also be used as an additional form of identification for authentication. (For sensitive resources, you may require multiple forms of identification – something you have [a key]; something you know [a password], and something you are [a biometric feature]. Digital signature proves that you have a key.)   SSL is a network-level security measure, which supports point-to-point security. It works between two network endpoints, but it becomes compromised (or fails completely) if the message needs to be routed through multiple intermediaries. SSL authentication offers strong authentication (based on a key), but the key belongs to the last network port – not necessary the originating client.   Regards, Anne   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 29, 2004 11:30 PM To: [EMAIL PROTECTED] Subject: RE: Signed SOAP messages   Digital Signature is a tool for achieving authentication. And SSL does a (Client/Server) authentication before the encryption process (that improvises confidentiality). So why do we need to do authentication again ( by signing the soap messages) ? At the application layer , are we assuming that  the soap messages can be mapped to users whose identity is independent of what the SSL reveals ? - Parag --------------------------------------------------------------------------------------------------------------------------------- With SSL, you can be reasonably sure that no one can listen to the conversation, but if the messages are signed as well, you can be sure of the identity of whom you are speaking with.  SSL alone does not do this.   Russ ***********************  HSS-Unclassified   ***********************