Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting.

Now my question is, after reading Understanding Protection Level what the advantage is of just signing? The fact that WCF will notice that someone has been messing around with the message and going to reject it or am I wrong?

Thanks in advance.

share|improve this question
up vote 2 down vote accepted

Encryption makes sure nobody else can read your message.

Signing makes sure it really comes from where it claims, and that nobody has changed the signed part.

Anyone can send you an encrypted message and claim it comes from someone else, as long as they have your public encryption key. But when they sign it, they need a private key, so if the signature checks out, you know that whoever wrote it had the private key in their possession.

share|improve this answer
Nice explanation, thanks! – Tom Kerkhove May 29 '13 at 18:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.