Home/ Questions/Q 6951209
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T14:11:26+00:00

I would like to know how message confidentiality is achieved for SOAP messages. My

  • 0

I would like to know how message confidentiality is achieved for SOAP messages.
My project uses IBM Websphere.In SOAP messages exchanged, there is

<wsse:KeyIdentifier>xxxx</wsse:KeyIdentifier>

It also has:

<EncryptionMethod Algorithm="yyyy"></EncryptionMethod>
<CipherData>
      <CipherValue>zzzzzzzzzzz</CipherValue>
</CipherData>

My doubt is whether can’t a third party decrypt the cipher text using the Key ?

If not how the receiver of this message is able to decrypt the message with the information available in the SOAP message?

Or is there any initial exchange of certificates required for this?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, you need to first set up a PKI infrastructure for this. The key identifier is just that, an identifier to select some private key from your key store – it is certainly not the key itself.

    Please make sure handle the contents of that field in a secure fashion, since an attacker may change the value as well. My own implementation silently ignores the field since the key has been set in advance.

    • 0