Newbie Encryption help

[Tim Williams <th...@gmail.com>]

Hi there,

I have a web service and client up and running using Axis. I would like to
enable encryption of the request and response messages. I'm having trouble
finding out how this is set up.

I realise that I have to include a handler for sending and recieving on both
the client and server sides (client-config.wsdd and my deployment.wsdd). The
thing is I'm not too sure on what parameters I need to set in these files.

I have 2 keystores, a server one (which has the clients public key imported
in it) and a client one (which has the servers public key in it).

Do I need to write a callback class to decrypt the message (on both the
client and the server), or can it all be done just through passing the right
paramets to the client?

Thanks in advanced
Tim Williams

RE: Newbie Encryption help

[Richard Wareing <wa...@rewc.com>]

Hi Tim,

 

I just started using WSS4J in the past couple weeks and have managed to
get signing and encryption working both ways.  As a newbie myself maybe
I can give you some pointers:

 

First make sure you created your key pairs correctly.  Remember to use
the -keyalg "RSA" argument when you are creating your key-pairs for
encryption.  The default DSA one cannot be used for encryption (i.e. DSA
= Signing, RSA = Encryption/Decryption).  Also remember to use the
-validity argument in conjunction with the -selfcert argument to extend
the validity of your certificates to some sensible time frame.

 

Links, links, links and more links you might find helpful (I did at
least):

 

Refresher course on Digital Signatures:

http://www.youdzone.com/signature.html

 

Good article on creating and signing keys with "keytool" (ignore the
WSS4J info at the end, wasn't really helpful):

http://www.devx.com/Java/Article/28816/0/page/1

 

Valuable WSS4J docs which have a few use case examples:

http://ws.apache.org/wss4j/package.html

 

Other tips I can give is install and look over the source code, and
check out WSHandler.java specifically so you can get a handle (no pun
intended) for how all the WSHandlerConstants are used (check out the
java docs for this class as well).

 

Good luck with WSS4J!

 

Richard Wareing

Reimer Technology Group

 

 

-----Original Message-----
From: Tim Williams [mailto:theshady@gmail.com] 
Sent: 2005 September 29 9:25 AM
To: wss4j-dev@ws.apache.org
Subject: Newbie Encryption help

 

Hi there, 

I have a web service and client up and running using Axis. I would like
to enable encryption of the request and response messages. I'm having
trouble finding out how this is set up. 

I realise that I have to include a handler for sending and recieving on
both the client and server sides (client-config.wsdd and my
deployment.wsdd). The thing is I'm not too sure on what parameters I
need to set in these files.

I have 2 keystores, a server one (which has the clients public key
imported in it) and a client one (which has the servers public key in
it).

Do I need to write a callback class to decrypt the message (on both the
client and the server), or can it all be done just through passing the
right paramets to the client?

Thanks in advanced
Tim Williams

RE: Newbie Encryption help

[Richard Wareing <wa...@rewc.com>]

Hi Tim,

 

I just started using WSS4J in the past couple weeks and have managed to
get signing and encryption working both ways.  As a newbie myself maybe
I can give you some pointers:

 

First make sure you created your key pairs correctly.  Remember to use
the -keyalg "RSA" argument when you are creating your key-pairs for
encryption.  The default DSA one cannot be used for encryption (i.e. DSA
= Signing, RSA = Encryption/Decryption).  Also remember to use the
-validity argument in conjunction with the -selfcert argument to extend
the validity of your certificates to some sensible time frame.

 

Links, links, links and more links you might find helpful (I did at
least):

 

Refresher course on Digital Signatures:

http://www.youdzone.com/signature.html

 

Good article on creating and signing keys with "keytool" (ignore the
WSS4J info at the end, wasn't really helpful):

http://www.devx.com/Java/Article/28816/0/page/1

 

Valuable WSS4J docs which have a few use case examples:

http://ws.apache.org/wss4j/package.html

 

Other tips I can give is install and look over the source code, and
check out WSHandler.java specifically so you can get a handle (no pun
intended) for how all the WSHandlerConstants are used (check out the
java docs for this class as well).

 

Good luck with WSS4J!

 

Richard Wareing

Reimer Technology Group

 

 

-----Original Message-----
From: Tim Williams [mailto:theshady@gmail.com] 
Sent: 2005 September 29 9:25 AM
To: wss4j-dev@ws.apache.org
Subject: Newbie Encryption help

 

Hi there, 

I have a web service and client up and running using Axis. I would like
to enable encryption of the request and response messages. I'm having
trouble finding out how this is set up. 

I realise that I have to include a handler for sending and recieving on
both the client and server sides (client-config.wsdd and my
deployment.wsdd). The thing is I'm not too sure on what parameters I
need to set in these files.

I have 2 keystores, a server one (which has the clients public key
imported in it) and a client one (which has the servers public key in
it).

Do I need to write a callback class to decrypt the message (on both the
client and the server), or can it all be done just through passing the
right paramets to the client?

Thanks in advanced
Tim Williams