Securing the SOAP Messages

Question

One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP.

My client has the following suggestions:

1. Encrypt the sensitive data with AES 128-bit using CTR and Padding.
2. Each time unique key will be generated which will be passed along with original information.

My view is, what's the real use if you are already sharing the Key in Message, any one can decrypt the message using key (am I missing anything?). Any ideas, what should I suggest for them in such scenario for better and secure communication?

It's not related to any login info. But this is still important info that should be secured as much as possible with minimum impact on overall.

Answer 1

Web-Services come with plenty of standards for securing data - so why roll your own? The WS-Security family of standards are supported by most Enterprise Service Buses (ESBs) out of the box and will ensure that you can integrate (which is the whole point of WS).

If you are using restful XML over HTTP (rather than SOAP) then just use the same security as you would if it were a web page.