I'm developing an ASP.NET 2.0 web service that serves XML data from a database. Almost all data traffic is one-way, from server to client, and there is no user-specific data. All clients will receive the same data. But I only want approved clients to be able to consume the data. In this situation, what are the best options for encrypting the data produced by the web service?
- I've looked at SSL, but I've been told by management to find another way, so that we can either avoid the hassle of setting up an SSL certificate on the site or implement both SSL and my solution.
- SOAP encryption has been suggested, but I want to have good support for iOS clients, and there does not appear to be SOAP support built into the iOS SDK or available open-source.
- Because no data is being modified server-side, and we have no user-specific data or user accounts, I don't think OAuth is necessary. It will become necessary in the future, but we'll cross that bridge when we come to it. Am I wrong here?
- I've suggested encrypting the content of the XML data so that
<Prop1>EncryptedGarbageHere</Prop1>, but I've been told that's not as secure an approach as SOAP encryption.
EDIT: In either case, I'm also planning on adding a sort of "password" parameter that is required by all WebMethods in the web service, and will be required of each unique client application.