You are viewing a plain text version of this content. The canonical link for it is here.
Posted to rampart-dev@ws.apache.org by Dobri Kitipov <kd...@googlemail.com> on 2007/11/16 09:27:41 UTC
Symmetric binding and useReqSigCert
Hi everybody,
there is a nice article called "Secure Message Exchanges with Multiple
Users" at http://wso2.org/library/255.
In this article we can read:
"
<encryptionUser>useReqSigCert</encryptionUser>
This instructs Rampart/WSS4J to use the certificate that was used to sign
the request. One can specify the encrypted parts to encrypt different parts
of the message to be encrypted.
"
My question is is it possible to use this with Symmetric binding? I could be
wrong but my understanding is that if this is supposed to work it will mean
that we want the derived key to be based on the lient's (initiator's)
security token (not the recipient's one), defined in the either encryption
token assertion or protection token assertion.
I know this make much more sense with the Asymmetric binding, but I am
curious about that.
Thank you.
Best regards, Dobri
Re: Symmetric binding and useReqSigCert
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Dobri,
do you know if current implementation of Rampart supports this behavior?
>
Yes, Rampart current implementation works as above.
Regards,
Nandana
>
> Best regards, Dobri
>
> On Nov 16, 2007 10:05 PM, Nandana Mihindukulasooriya <
> nandana.cse@gmail.com>
> wrote:
>
> > Hi Dobri,
> >
> > my question is why in case of Symmetric binding there is need of the
> > > following parameter:
> > >
> > > <ramp:encryptionUser>client</ramp:encryptionUser>
> >
> >
> > I think when using the Symmetric binding, in the client side
> configuration
> > we
> > actually need to have only the <ramp:encryptionUser/> property. This
> alias
> > is
> > used to find the certificate to encrypt symmetric key in the encrypted
> > key.
> > And in the server side we only need to have the <ramp:user/> or
> > <ramp:userCertAlias/> property and this alias is used to find the cert
> to
> > decrypt
> > the encrypted key.
> > But this is true only if we don't have any supporting tokens. If we have
> > supporting
> > tokens we always have to have <ramp:user/> property in the client side
> > configuration.
> >
> > Regards,
> > Nandana
> >
> >
> >
> >
> > > Regards, Dobri
> > >
> > > On Nov 16, 2007 10:27 AM, Dobri Kitipov <
> kdobrik.rampart@googlemail.com>
> > > wrote:
> > >
> > > > Hi everybody,
> > > > there is a nice article called "Secure Message Exchanges with
> Multiple
> > > > Users" at http://wso2.org/library/255.
> > > > In this article we can read:
> > > >
> > > > "
> > > > <encryptionUser>useReqSigCert</encryptionUser>
> > > >
> > > > This instructs Rampart/WSS4J to use the certificate that was used to
> > > sign
> > > > the request. One can specify the encrypted parts to encrypt
> different
> > > parts
> > > > of the message to be encrypted.
> > > > "
> > > >
> > > > My question is is it possible to use this with Symmetric binding? I
> > > could
> > > > be wrong but my understanding is that if this is supposed to work it
> > > will
> > > > mean that we want the derived key to be based on the lient's
> > > (initiator's)
> > > > security token (not the recipient's one), defined in the either
> > > encryption
> > > > token assertion or protection token assertion.
> > > > I know this make much more sense with the Asymmetric binding, but I
> am
> > > > curious about that.
> > > >
> > > > Thank you.
> > > >
> > > > Best regards, Dobri
> > > >
> > > >
> > >
> >
>
Re: Symmetric binding and useReqSigCert
Posted by Dobri Kitipov <kd...@googlemail.com>.
Hi Nandana,
do you know if current implementation of Rampart supports this behavior?
Best regards, Dobri
On Nov 16, 2007 10:05 PM, Nandana Mihindukulasooriya <na...@gmail.com>
wrote:
> Hi Dobri,
>
> my question is why in case of Symmetric binding there is need of the
> > following parameter:
> >
> > <ramp:encryptionUser>client</ramp:encryptionUser>
>
>
> I think when using the Symmetric binding, in the client side configuration
> we
> actually need to have only the <ramp:encryptionUser/> property. This alias
> is
> used to find the certificate to encrypt symmetric key in the encrypted
> key.
> And in the server side we only need to have the <ramp:user/> or
> <ramp:userCertAlias/> property and this alias is used to find the cert to
> decrypt
> the encrypted key.
> But this is true only if we don't have any supporting tokens. If we have
> supporting
> tokens we always have to have <ramp:user/> property in the client side
> configuration.
>
> Regards,
> Nandana
>
>
>
>
> > Regards, Dobri
> >
> > On Nov 16, 2007 10:27 AM, Dobri Kitipov <kd...@googlemail.com>
> > wrote:
> >
> > > Hi everybody,
> > > there is a nice article called "Secure Message Exchanges with Multiple
> > > Users" at http://wso2.org/library/255.
> > > In this article we can read:
> > >
> > > "
> > > <encryptionUser>useReqSigCert</encryptionUser>
> > >
> > > This instructs Rampart/WSS4J to use the certificate that was used to
> > sign
> > > the request. One can specify the encrypted parts to encrypt different
> > parts
> > > of the message to be encrypted.
> > > "
> > >
> > > My question is is it possible to use this with Symmetric binding? I
> > could
> > > be wrong but my understanding is that if this is supposed to work it
> > will
> > > mean that we want the derived key to be based on the lient's
> > (initiator's)
> > > security token (not the recipient's one), defined in the either
> > encryption
> > > token assertion or protection token assertion.
> > > I know this make much more sense with the Asymmetric binding, but I am
> > > curious about that.
> > >
> > > Thank you.
> > >
> > > Best regards, Dobri
> > >
> > >
> >
>
Re: Symmetric binding and useReqSigCert
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Dobri,
my question is why in case of Symmetric binding there is need of the
> following parameter:
>
> <ramp:encryptionUser>client</ramp:encryptionUser>
I think when using the Symmetric binding, in the client side configuration
we
actually need to have only the <ramp:encryptionUser/> property. This alias
is
used to find the certificate to encrypt symmetric key in the encrypted
key.
And in the server side we only need to have the <ramp:user/> or
<ramp:userCertAlias/> property and this alias is used to find the cert to
decrypt
the encrypted key.
But this is true only if we don't have any supporting tokens. If we have
supporting
tokens we always have to have <ramp:user/> property in the client side
configuration.
Regards,
Nandana
> Regards, Dobri
>
> On Nov 16, 2007 10:27 AM, Dobri Kitipov <kd...@googlemail.com>
> wrote:
>
> > Hi everybody,
> > there is a nice article called "Secure Message Exchanges with Multiple
> > Users" at http://wso2.org/library/255.
> > In this article we can read:
> >
> > "
> > <encryptionUser>useReqSigCert</encryptionUser>
> >
> > This instructs Rampart/WSS4J to use the certificate that was used to
> sign
> > the request. One can specify the encrypted parts to encrypt different
> parts
> > of the message to be encrypted.
> > "
> >
> > My question is is it possible to use this with Symmetric binding? I
> could
> > be wrong but my understanding is that if this is supposed to work it
> will
> > mean that we want the derived key to be based on the lient's
> (initiator's)
> > security token (not the recipient's one), defined in the either
> encryption
> > token assertion or protection token assertion.
> > I know this make much more sense with the Asymmetric binding, but I am
> > curious about that.
> >
> > Thank you.
> >
> > Best regards, Dobri
> >
> >
>
Re: Symmetric binding and useReqSigCert
Posted by Dobri Kitipov <kd...@googlemail.com>.
Hi again,
I just want to extend a little bit the question and apply the following
rampart configuration example:
<ramp:RampartConfig xmlns:ramp="
http://ws.apache.org/rampart/policy">
<ramp:user>service</ramp:user>
<ramp:encryptionUser>client</ramp:encryptionUser>
<ramp:passwordCallbackClass>
com.mycompany.wsstack.pwcb.PasswordCallbackHandler
</ramp:passwordCallbackClass>
<ramp:signatureCrypto>
<ramp:crypto provider="
org.apache.ws.security.components.crypto.Merlin">
<ramp:property name="
org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
<ramp:property name="
org.apache.ws.security.crypto.merlin.file">service.jks</ramp:property>
<ramp:property name="
org.apache.ws.security.crypto.merlin.keystore.password
">openssl</ramp:property>
</ramp:crypto>
</ramp:signatureCrypto>
<ramp:encryptionCypto>
<ramp:crypto provider="
org.apache.ws.security.components.crypto.Merlin">
<ramp:property name="
org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
<ramp:property name="
org.apache.ws.security.crypto.merlin.file">service.jks</ramp:property>
<ramp:property name="
org.apache.ws.security.crypto.merlin.keystore.password
">openssl</ramp:property>
</ramp:crypto>
</ramp:encryptionCypto>
</ramp:RampartConfig>
my question is why in case of Symmetric binding there is need of the
following parameter:
<ramp:encryptionUser>client</ramp:encryptionUser>
because AFAIK the symmetric binding facilitates the need to secure the
messages between anonymous clients and the server.
Thanks again and have a nice day!
Regards, Dobri
On Nov 16, 2007 10:27 AM, Dobri Kitipov <kd...@googlemail.com>
wrote:
> Hi everybody,
> there is a nice article called "Secure Message Exchanges with Multiple
> Users" at http://wso2.org/library/255.
> In this article we can read:
>
> "
> <encryptionUser>useReqSigCert</encryptionUser>
>
> This instructs Rampart/WSS4J to use the certificate that was used to sign
> the request. One can specify the encrypted parts to encrypt different parts
> of the message to be encrypted.
> "
>
> My question is is it possible to use this with Symmetric binding? I could
> be wrong but my understanding is that if this is supposed to work it will
> mean that we want the derived key to be based on the lient's (initiator's)
> security token (not the recipient's one), defined in the either encryption
> token assertion or protection token assertion.
> I know this make much more sense with the Asymmetric binding, but I am
> curious about that.
>
> Thank you.
>
> Best regards, Dobri
>
>
Re: Symmetric binding and useReqSigCert
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Dobri,
<encryptionUser>useReqSigCert</encryptionUser>
>
> My question is is it possible to use this with Symmetric binding?
Good question. When a symmetric binding is used
encrpted
key is created and that encrypted key is used to sign and encrypt the
messages back and forth. So we won't be able to get the certificate that
used to sign the message as the message is signed using the encrypted
key not the initiators signature. But it won't be a problem as in Symmetric
binding case we don't need the initiators certificate to encrypt the message
as the message is encrypted using the encrypted key.
And one more thing. If the policy specifies an endorsing
supporting
token or signed endorsing supporting token, then the message signature
signed
using the endorsing supporting token. In that case, we use initiator
certificate
(if the supporting token is a X509 cert) to sign the message signature.
However
we don't need this certificate to encrypt the message back to the initiator
as
encrypted key is used for that purpose.
Regards,
Nandana
>
>
> Thank you.
>
> Best regards, Dobri
>