You are viewing a plain text version of this content. The canonical link for it is here.
Posted to fx-dev@ws.apache.org by Wacław Borowiec <wy...@googlemail.com> on 2007/05/01 13:15:03 UTC
client public key
Hello
I want to provide a service with two-way encryption. I don't want client's
public key to be permanently stored on server's side. Is it possible to
fetch client's certificate when he sends the request and use it for
encryption of the answer?
I'll be grateful for any help
Waclaw Borowiec
AW: client public key
Posted by "Dittmann, Werner" <we...@nsn.com>.
If you are using either Axis1 or Axis2 handlers then you might have
look into the javadoc of WSHandlerConstants and search for the following
parameter description:
/**
* Specifying this name as {@link ENCRYPTION_USER}
* triggers a special action to get the public key to use for encryption.
* <p/>
* The handler uses the public key of the sender's certificate. Using
this
* way to define an encryption key simplifies certificate management to
* a large extend.
*/
public static final String USE_REQ_SIG_CERT = "useReqSigCert";
This effectively takes the public key of the client's certificate and
uses if to encrypt the session key of the answer. Please have a look
into
the WSS4J FAQ <http://wiki.apache.org/ws/FrontPage/WsFx/wss4jFAQ>, and
the secion 9 that shows how to handle this.
Regards,
Werner
________________________________
Von: ext Waclaw Borowiec [mailto:wyborowiec@googlemail.com]
Gesendet: Dienstag, 1. Mai 2007 13:15
An: wss4j-dev@ws.apache.org
Betreff: client public key
Hello
I want to provide a service with two-way encryption. I don't
want client's public key to be permanently stored on server's side. Is
it possible to fetch client's certificate when he sends the request and
use it for encryption of the answer?
I'll be grateful for any help
Waclaw Borowiec
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: client public key
Posted by Ruchith Fernando <ru...@gmail.com>.
On 5/3/07, George Stanchev <Gs...@serena.com> wrote:
> Fred,
>
> Next rampart would be based on the next release WSS4J correct?
> Would the crypto provider enhancements be available there?
Yes
Thanks,
Ruchith
>
> Best Regards,
> George
>
> -----Original Message-----
> From: Fred Dushin [mailto:fred@dushin.net]
> Sent: Wednesday, May 02, 2007 12:54 PM
> To: Wacław Borowiec
> Cc: wss4j-dev@ws.apache.org
> Subject: Re: client public key
>
> That depends partly on how you are using the toolkit, and if your client is also willing to do message signature with the private key associated with the public key with which you would like the server will encrypt the response.
>
> If you're writing to the low-level APIs (primarily the classes in org.apache.ws.security.message, then yes, I think you should be able to do this. Your client will need to use the DirectReference KeyIdentifier when signing (and presumably encrypting) the request, so that the certificate gets sent as a BinarySecurityToken in the security header. After processing the security headers, the signing certificate should be available on the results vector, in which case you can turn around and use (the public key in) that certificate to do the encryption of the response. You may need to fudge things a bit, though, to get a Keystore set up with all the right pieces (viz., the certificate you received), but it otherwise should be doable.
>
> The next release of WSS4J should actually make construction of a Crypto a tiny bit easier in a scenario like this, because you can now instantiate a Crypto using a previously instantiated Keystore.
>
> -Fred
>
> On May 1, 2007, at 7:15 AM, Wacław Borowiec wrote:
>
> > Hello
> >
> > I want to provide a service with two-way encryption. I don't want
> > client's public key to be permanently stored on server's side. Is it
> > possible to fetch client's certificate when he sends the request and
> > use it for encryption of the answer?
> >
> > I'll be grateful for any help
> > Waclaw Borowiec
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
> **********************************************************************
> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
--
www.ruchith.org
www.wso2.org
Re: client public key
Posted by Ruchith Fernando <ru...@gmail.com>.
On 5/3/07, George Stanchev <Gs...@serena.com> wrote:
> Fred,
>
> Next rampart would be based on the next release WSS4J correct?
> Would the crypto provider enhancements be available there?
Yes
Thanks,
Ruchith
>
> Best Regards,
> George
>
> -----Original Message-----
> From: Fred Dushin [mailto:fred@dushin.net]
> Sent: Wednesday, May 02, 2007 12:54 PM
> To: Wacław Borowiec
> Cc: wss4j-dev@ws.apache.org
> Subject: Re: client public key
>
> That depends partly on how you are using the toolkit, and if your client is also willing to do message signature with the private key associated with the public key with which you would like the server will encrypt the response.
>
> If you're writing to the low-level APIs (primarily the classes in org.apache.ws.security.message, then yes, I think you should be able to do this. Your client will need to use the DirectReference KeyIdentifier when signing (and presumably encrypting) the request, so that the certificate gets sent as a BinarySecurityToken in the security header. After processing the security headers, the signing certificate should be available on the results vector, in which case you can turn around and use (the public key in) that certificate to do the encryption of the response. You may need to fudge things a bit, though, to get a Keystore set up with all the right pieces (viz., the certificate you received), but it otherwise should be doable.
>
> The next release of WSS4J should actually make construction of a Crypto a tiny bit easier in a scenario like this, because you can now instantiate a Crypto using a previously instantiated Keystore.
>
> -Fred
>
> On May 1, 2007, at 7:15 AM, Wacław Borowiec wrote:
>
> > Hello
> >
> > I want to provide a service with two-way encryption. I don't want
> > client's public key to be permanently stored on server's side. Is it
> > possible to fetch client's certificate when he sends the request and
> > use it for encryption of the answer?
> >
> > I'll be grateful for any help
> > Waclaw Borowiec
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
> **********************************************************************
> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
--
www.ruchith.org
www.wso2.org
RE: client public key
Posted by George Stanchev <Gs...@serena.com>.
Fred,
Next rampart would be based on the next release WSS4J correct?
Would the crypto provider enhancements be available there?
Best Regards,
George
-----Original Message-----
From: Fred Dushin [mailto:fred@dushin.net]
Sent: Wednesday, May 02, 2007 12:54 PM
To: Wacław Borowiec
Cc: wss4j-dev@ws.apache.org
Subject: Re: client public key
That depends partly on how you are using the toolkit, and if your client is also willing to do message signature with the private key associated with the public key with which you would like the server will encrypt the response.
If you're writing to the low-level APIs (primarily the classes in org.apache.ws.security.message, then yes, I think you should be able to do this. Your client will need to use the DirectReference KeyIdentifier when signing (and presumably encrypting) the request, so that the certificate gets sent as a BinarySecurityToken in the security header. After processing the security headers, the signing certificate should be available on the results vector, in which case you can turn around and use (the public key in) that certificate to do the encryption of the response. You may need to fudge things a bit, though, to get a Keystore set up with all the right pieces (viz., the certificate you received), but it otherwise should be doable.
The next release of WSS4J should actually make construction of a Crypto a tiny bit easier in a scenario like this, because you can now instantiate a Crypto using a previously instantiated Keystore.
-Fred
On May 1, 2007, at 7:15 AM, Wacław Borowiec wrote:
> Hello
>
> I want to provide a service with two-way encryption. I don't want
> client's public key to be permanently stored on server's side. Is it
> possible to fetch client's certificate when he sends the request and
> use it for encryption of the answer?
>
> I'll be grateful for any help
> Waclaw Borowiec
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
**********************************************************************
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
RE: client public key
Posted by George Stanchev <Gs...@serena.com>.
Fred,
Next rampart would be based on the next release WSS4J correct?
Would the crypto provider enhancements be available there?
Best Regards,
George
-----Original Message-----
From: Fred Dushin [mailto:fred@dushin.net]
Sent: Wednesday, May 02, 2007 12:54 PM
To: Wacław Borowiec
Cc: wss4j-dev@ws.apache.org
Subject: Re: client public key
That depends partly on how you are using the toolkit, and if your client is also willing to do message signature with the private key associated with the public key with which you would like the server will encrypt the response.
If you're writing to the low-level APIs (primarily the classes in org.apache.ws.security.message, then yes, I think you should be able to do this. Your client will need to use the DirectReference KeyIdentifier when signing (and presumably encrypting) the request, so that the certificate gets sent as a BinarySecurityToken in the security header. After processing the security headers, the signing certificate should be available on the results vector, in which case you can turn around and use (the public key in) that certificate to do the encryption of the response. You may need to fudge things a bit, though, to get a Keystore set up with all the right pieces (viz., the certificate you received), but it otherwise should be doable.
The next release of WSS4J should actually make construction of a Crypto a tiny bit easier in a scenario like this, because you can now instantiate a Crypto using a previously instantiated Keystore.
-Fred
On May 1, 2007, at 7:15 AM, Wacław Borowiec wrote:
> Hello
>
> I want to provide a service with two-way encryption. I don't want
> client's public key to be permanently stored on server's side. Is it
> possible to fetch client's certificate when he sends the request and
> use it for encryption of the answer?
>
> I'll be grateful for any help
> Waclaw Borowiec
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
**********************************************************************
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: client public key
Posted by Fred Dushin <fr...@dushin.net>.
That depends partly on how you are using the toolkit, and if your
client is also willing to do message signature with the private key
associated with the public key with which you would like the server
will encrypt the response.
If you're writing to the low-level APIs (primarily the classes in
org.apache.ws.security.message, then yes, I think you should be able
to do this. Your client will need to use the DirectReference
KeyIdentifier when signing (and presumably encrypting) the request,
so that the certificate gets sent as a BinarySecurityToken in the
security header. After processing the security headers, the signing
certificate should be available on the results vector, in which case
you can turn around and use (the public key in) that certificate to
do the encryption of the response. You may need to fudge things a
bit, though, to get a Keystore set up with all the right pieces
(viz., the certificate you received), but it otherwise should be doable.
The next release of WSS4J should actually make construction of a
Crypto a tiny bit easier in a scenario like this, because you can now
instantiate a Crypto using a previously instantiated Keystore.
-Fred
On May 1, 2007, at 7:15 AM, Wacław Borowiec wrote:
> Hello
>
> I want to provide a service with two-way encryption. I don't want
> client's public key to be permanently stored on server's side. Is
> it possible to fetch client's certificate when he sends the request
> and use it for encryption of the answer?
>
> I'll be grateful for any help
> Waclaw Borowiec
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
AW: client public key
Posted by "Dittmann, Werner" <we...@nsn.com>.
If you are using either Axis1 or Axis2 handlers then you might have
look into the javadoc of WSHandlerConstants and search for the following
parameter description:
/**
* Specifying this name as {@link ENCRYPTION_USER}
* triggers a special action to get the public key to use for encryption.
* <p/>
* The handler uses the public key of the sender's certificate. Using
this
* way to define an encryption key simplifies certificate management to
* a large extend.
*/
public static final String USE_REQ_SIG_CERT = "useReqSigCert";
This effectively takes the public key of the client's certificate and
uses if to encrypt the session key of the answer. Please have a look
into
the WSS4J FAQ <http://wiki.apache.org/ws/FrontPage/WsFx/wss4jFAQ>, and
the secion 9 that shows how to handle this.
Regards,
Werner
________________________________
Von: ext Waclaw Borowiec [mailto:wyborowiec@googlemail.com]
Gesendet: Dienstag, 1. Mai 2007 13:15
An: wss4j-dev@ws.apache.org
Betreff: client public key
Hello
I want to provide a service with two-way encryption. I don't
want client's public key to be permanently stored on server's side. Is
it possible to fetch client's certificate when he sends the request and
use it for encryption of the answer?
I'll be grateful for any help
Waclaw Borowiec
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: client public key
Posted by Fred Dushin <fr...@dushin.net>.
That depends partly on how you are using the toolkit, and if your
client is also willing to do message signature with the private key
associated with the public key with which you would like the server
will encrypt the response.
If you're writing to the low-level APIs (primarily the classes in
org.apache.ws.security.message, then yes, I think you should be able
to do this. Your client will need to use the DirectReference
KeyIdentifier when signing (and presumably encrypting) the request,
so that the certificate gets sent as a BinarySecurityToken in the
security header. After processing the security headers, the signing
certificate should be available on the results vector, in which case
you can turn around and use (the public key in) that certificate to
do the encryption of the response. You may need to fudge things a
bit, though, to get a Keystore set up with all the right pieces
(viz., the certificate you received), but it otherwise should be doable.
The next release of WSS4J should actually make construction of a
Crypto a tiny bit easier in a scenario like this, because you can now
instantiate a Crypto using a previously instantiated Keystore.
-Fred
On May 1, 2007, at 7:15 AM, Wacław Borowiec wrote:
> Hello
>
> I want to provide a service with two-way encryption. I don't want
> client's public key to be permanently stored on server's side. Is
> it possible to fetch client's certificate when he sends the request
> and use it for encryption of the answer?
>
> I'll be grateful for any help
> Waclaw Borowiec
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org