Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm attempting to build a SOAP client to consume the services provided by eMedNy. They've provided me with a client X.509 certificate along with their server X.509 certificate.

Their user guide contains the following sample SOAP request:

    <?xml version="1.0" encoding="utf-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:mhs="http://org/emedny/mhs/" xmlns:urn="urn:hl7-org:v3">
  <soapenv:Header>
    <wsse:Security soap:mustUnderstand="1" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-e00c8062-83d2-4f04-88fc-996218e7bb3d">MIICeDCC....(eMedNY signed user MLS cert).......</wsse:BinarySecurityToken>
      <wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-c0cc2cd4-cb77-4fa5-abfa-bd485afd1685">MIIDFj.....( eMedNY MLS web-service end-point public cert)........</wsse:BinarySecurityToken>
      <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-970e9a80-00cc-4c86-8ec4-3ba16e029a5b">
        <wsse:Username>....your_username.....</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">.....your_plaintext_password....</wsse:Password>
        <wsse:Nonce>KNyu6MsXCkTg4DDyvwvEiw==</wsse:Nonce>
        <wsu:Created>2010-09-15T18:00:30Z</wsu:Created>
      </wsse:UsernameToken>
      <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference>
            <wsse:Reference URI="#SecurityToken-c0cc2cd4-cb77-4fa5-abfa-bd485afd1685" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
          </wsse:SecurityTokenReference>
        </KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>gpBAWt91pdwhKva............</xenc:CipherValue>
        </xenc:CipherData>
        <xenc:ReferenceList>
          <xenc:DataReference URI="#Enc-0641b860-b16d-4941-91c0-d60bece67794"/>
        </xenc:ReferenceList>
      </xenc:EncryptedKey>
      <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
          <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <Reference URI="#Id-f10674fd-b999-47c9-9568-c11fa5e5405b">
            <Transforms>
              <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <DigestValue>wRUq.........</DigestValue>
          </Reference>
        </SignedInfo>
        <SignatureValue>tBSsaZi........</SignatureValue>
        <KeyInfo>
          <wsse:SecurityTokenReference>
            <wsse:Reference URI="#SecurityToken-e00c8062-83d2-4f04-88fc-996218e7bb3d" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
          </wsse:SecurityTokenReference>
        </KeyInfo>
      </Signature>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body wsu:Id="Id-f10674fd-b999-47c9-9568-c11fa5e5405b" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <xenc:EncryptedData Id="Enc-0641b860-b16d-4941-91c0-d60bece67794" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
      <xenc:CipherData>
        <xenc:CipherValue>SQsTCAK6ZaVhojB8+Y.........</xenc:CipherValue>
      </xenc:CipherData>
    </xenc:EncryptedData>
  </soapenv:Body>
</soapenv:Envelope>

I just wanted to verify the following two points to make sure my understanding is accurate:

  1. The SOAP body gets encrypted using the eMedNy server certificate using TRIPLE-DES. We then encrypt this server certificate using RSA and send it as a message header.

  2. To generate the digital signature, we take the TRIPLE-DES encrypted message body and obtain a SHA-1 digest. Using the eMedNy-supplied X.509 client certificate, we encrypt the digest which gives us the signature.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The client proceeds as follows (I am considering only the encryption and signature steps as these are relevant for you):

1) Encryption:

  • It generates a fresh 3DES symmetric key
  • It encrypts the newly generated symmetric key with the public key of the server (using the RSA-PKCS1 algorithm, see EncryptionMethod algorithm) and places it into the EncryptedKey/CipherData/CipherValue element.
  • The public key used for encryption is referenced using the EncryptedKey/KeyInfo/SecurityTokenReference/Reference element. There we can see that the public key from certificate wsu:Id="Sec...1685" was used. Once the server accepts the message it knows that it should use the corresponding private key for decryption.
  • The generated symmetric key is used for SOAP Body encryption, with a 3DES-CBC algorithm.

2) Signature:

  • The client computes a SHA-1 digest over the whole SOAP Body. You can see this since the Reference element references an element with wsu:Id="Id...05b", which belongs to the SOAP Body. The digest value is then placed into Signature/SignedInfo/Reference/DigestValue.
  • The client uses its private key and computes an RSA-SHA1 signature over the SignedInfo element. The signature value is then placed into the SignatureValue element.
  • In order to validate the signature, the server needs to know the client's public key. For this purpose, the client places its certificate into the message and references it in Signature/KeyInfo/SecurityTokenReference/Reference. Once the server accepts the message, it knows that it has to use a certificate with wsu:Id="Security...bb3d" to get the public key and verify the signature.
share|improve this answer
    
Yes, this is correct; by now I've figured it out.. –  Isaac Kleinman Mar 18 at 13:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.