WCF Transport vs Message

Question

I read about WCF security implementation and found out that there are 2 types of security: Transport Mode and Message Mode (or both)

If I used HTTPS for transport mode, is it more secure if I also used message protection? I ask about this because I understand the following:

https uses SSL, which encrypts messages ... so why should I add Message Security and encrypt an encrypted SSL message? or i don't understand things?

Answer 1

Security in WCF actually consists of several functions . The difference between the two is how messages are signed and encrypted.

Transport safety provides only two-point channel protection. This means that HTTPS establishes a secure channel only between the client and the server exposed to the client. But if this server is just a load balancer or reverse proxy, it has direct access to the contents of the message.

Message security provides end-to-end channel protection. This means that security is part of the transmitted data, and only the intended recipient can decrypt the data (the load balancer or proxy sees only the encrypted message). Message security in most cases also uses certificates to provide encryption and signing, but it is usually slower because transport security can use HW acceleration.

In advanced scenarios, these methods can be combined. For example, you may have a connection with your HTTPS protected load balancer because you trust your internal network after load balancing, but at the same time you can subscribe to a message (message security) so you can prove that it wasn’t changed.

Another difference between the two is that transport security is associated with a single transport protocol, while message security is independent of the transport protocol.

Message security is based on compatible protocols (but keep in mind that not every WCF configuration is compatible). WCF supports at least partially these protocols:

• WS-Security 1.0 and 1.1 - the basic rules for encryption, signature, transfer of tokens, timestamps, etc.
• UserName 1.0 Token Profile - Defines the token used to transport the username and password. This specification is only partially implemented, because WCF out of the box does not support the digested password and requires the use of this token using either transport or message encryption.
• X509 Token Profile 1.1 - Defines the token used to transport certificates.
• Kerberos 1.1 Token Profile - Defines the token used to transport Kerberos tickets.
• The SAML Token Profile 1.1 1.0 and 1.1 is the definition of the token used for federated security. SAML 2.0 is provided by WIF.
• WS-SecurityPolicy 1.1 and 1.2 - Provides support for defining a security statement in the WSDL.
• WS-SecureConversation 1.3 and Feb. 2005 - Provides support for a security session in which credentials are exchanged only during the first call, and the rest of the connection uses a unique security token.
• WS-Trust 1.3 and February 2005 - Provides support for federated scripting and security token services (STS).

WCF also supports the WS-I Basic Security Profile 1.0, which is simply a subset of the legacy protocols with the given configuration.

For incompatible features, WCF offers features such as Windows Security or TLSNego and SPNego (both should be generally compatible, but not available in many SOAP packages) for sharing service credentials.

Answer 2

This indicates reasons for using or not using message security.

In principle, transport safety is preferred if it cannot be used.

Excerpt from the link:

Pros and Cons of Transport Level Security

Transport safety has the following advantages:

Does not require the understanding parties to the XML-level Security Concept. This can improve compatibility, for example, when HTTPS is used to protect a message.

Overall improved performance.

Hardware accelerators are available.

Streaming is possible.

Transport safety has the following disadvantages:

Hop hop only.

A limited and inextensible set of credentials.

Transport dependent.

Message Level Disadvantages Security

Message security has the following disadvantages:

Performance

Cannot use streaming message.

Requires implementation of XML level security mechanisms and support for the WS-Security specification. This may affect interoperability.

Answer 3

There are also cases where you cannot have transport layer encryption and thus “backtrack” to message layer encryption, which is slightly less secure than transport layer security.

Doing both will be safer of course. But this is a bit overkill when you have good security at the transport level.

Answer 4

I would say that in most cases this should be enough for one or the other. If you can use secure transport security, which is preferable, because it encrypts the entire communication, and not just the message content.