Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting.

Now my question is, after reading Understanding Protection Level what the advantage is of just signing? The fact that WCF will notice that someone has been messing around with the message and going to reject it or am I wrong?

Thanks in advance.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Encryption makes sure nobody else can read your message.

Signing makes sure it really comes from where it claims, and that nobody has changed the signed part.

Anyone can send you an encrypted message and claim it comes from someone else, as long as they have your public encryption key. But when they sign it, they need a private key, so if the signature checks out, you know that whoever wrote it had the private key in their possession.

share|improve this answer
    
Nice explanation, thanks! –  Tom Kerkhove May 29 '13 at 18:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.