Mailing-List: contact axis-user-help@ws.apache.org; run by ezmlm
Precedence: bulk
Reply-To: axis-user@ws.apache.org
Received-SPF: pass (nike.apache.org: domain of jose.ferreiro@gmail.com
 designates 216.239.58.190 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:reply-to:to:subject:mime-version:content-type;
        b=O843d06/avHiQ8Reck2Dj9G5jfTq11FZB6vyHceDgvPYhEN974Kah/3rKl230QUanETje1ay8SgNidc9k5aMAprzzevV0OKl+y2fL6axOZ9N0YHyj6PBbnW2xxxcRySmfRfz2m1DNXpTCUzI2uu+HJSgfDSvd4G84yB7YZbWDV4=
Message-ID: <4e3ba4880804210802v136fb7ct975e958d3d2e6a51@mail.gmail.com>
Date: Mon, 21 Apr 2008 17:02:58 +0200
From: "=?UTF-8?Q?Jos=C3=A9_Ferreiro?=" <jose.ferreiro@gmail.com>
Reply-To: j.o.s.e.f.e.r.r.e.i.r.o@gmail.com
To: wss4j-dev@ws.apache.org, axis-user@ws.apache.org
Subject: WSS4J: Hybrid system (Symmetric and asymmetric cryptography)
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_14424_22904612.1208790178997"

------=_Part_14424_22904612.1208790178997
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

*Hello,*
**
Definitions:
Asymmetric cryptography: Form of cryptography in which a user has a pair of
cryptographic keys (a *public key* and a *private key*)
Symmetric cryptography:  Form of cryptography in which many user shared a
secret-key (*single key*)

*WSS4J works as follows for encryption*:

WSS4J generates a random session key (*single key*) for every new "session"
(SOAP message), encrypts the data using the *single key*.
The server's *public key* (usually contained in a X.509 certificate)
encrypts the *session key* and packs it into the relevant SOAP header
structure.

Is this correct?
Which is the default *symmetric* algorithm to encrypt the SOAP body data in
WSS4J? Is it aes128-cbc?
Which is the default *asymmetric* algorithm to encrypt the symmetric
key (*single
key*) in WSS4J? Is it RSA?


*WSS4J works as follows for signing*:

The client uses its *private key* to sign the SOAP body. The server uses the
client's public key to check the signature of the SOAP body content using a
cryptographic hash fuction.
The client's public key is usually contained in a signed certificate by a
Certificate Authority (such as Verisign)

Is this correct?
 Which is the default hash algorithm to sign the SOA body data in WSS4J? Is
it SHA-1?

Thank you in advance for your comments.

Jose Ferreiro

------=_Part_14424_22904612.1208790178997
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

<div><strong>Hello,</strong></div>
<div><strong></strong>&nbsp;</div>
<div>Definitions:</div>
<div>Asymmetric cryptography: Form of cryptography in which a user has a pair of cryptographic keys (a <strong>public key</strong> and a <strong>private key</strong>)</div>
<div>Symmetric&nbsp;cryptography:&nbsp; Form of cryptography in which many user shared a secret-key (<strong>single key</strong>)</div>
<div>&nbsp;</div>
<div><u><strong>WSS4J works as follows for encryption</strong></u>:</div>
<div>&nbsp;</div>
<div>WSS4J generates a random session key (<strong>single key</strong>) for every new &quot;session&quot; (SOAP message), encrypts the data using the <strong>single key</strong>.</div>
<div>The server&#39;s <strong>public key</strong> (usually contained in a X.509 certificate) encrypts the <strong>session key</strong> and packs it into the relevant SOAP header structure.</div>
<div>&nbsp;</div>
<div>Is this correct?</div>
<div>Which is the default <strong>symmetric</strong> algorithm to encrypt the SOAP body data in WSS4J? Is it aes128-cbc?</div>
<div>Which is the default <strong>asymmetric</strong> algorithm to encrypt the symmetric key (<strong>single key</strong>) in WSS4J? Is it RSA?</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div><u><strong>WSS4J works as follows for signing</strong></u>:</div>
<div>&nbsp;</div>
<div>The client uses its <strong>private key</strong> to sign the SOAP body. The server uses the client&#39;s public key to check the signature of the SOAP body content using a cryptographic hash fuction.</div>
<div>The client&#39;s public key is usually contained in a signed certificate by a Certificate Authority (such as Verisign)</div>
<div>&nbsp;</div>
<div>Is this correct?</div>
<div>
<div>Which is the default&nbsp;hash algorithm to&nbsp;sign the SOA body data in WSS4J? Is it SHA-1?</div>
<div>&nbsp;</div>
<div>Thank you in advance for your comments.</div>
<div>&nbsp;</div>
<div>Jose Ferreiro</div></div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>&nbsp;</div>

------=_Part_14424_22904612.1208790178997--