Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP.

My client has the following suggestions:

  1. Encrypt the sensitive data with AES 128-bit using CTR and Padding.
  2. Each time unique key will be generated which will be passed along with original information.

My view is, what's the real use if you are already sharing the Key in Message, any one can decrypt the message using key (am I missing anything?). Any ideas, what should I suggest for them in such scenario for better and secure communication?

It's not related to any login info. But this is still important info that should be secured as much as possible with minimum impact on overall.

share|improve this question
add comment

1 Answer

Web-Services come with plenty of standards for securing data - so why roll your own? The WS-Security family of standards are supported by most Enterprise Service Buses (ESBs) out of the box and will ensure that you can integrate (which is the whole point of WS).

If you are using restful XML over HTTP (rather than SOAP) then just use the same security as you would if it were a web page.

share|improve this answer
    
Because we don't want them in each one of the services. We want to implement for particular/specific data which they want it to be done from Java side –  Nitin Gurram Feb 4 '13 at 10:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.