securing web method calls using .NET 1.1

[The Big Fat Sloppy Pig!]

x-no-archive: yes

Hi All:

I'm sort of "new" to doing this so I was wondering if anyone can offer some
additional insight/suggestions.

I've created a web-service that will be receiving some customer-critical
information. I've written both the client application and the web-service.
We need to make sure the data is "non-translatable" as much as possible.
Ultimately, we could use SSL on top of the web-service but in the mean time,
I've decided to use the Cryptography features of .NET 1.1 to send the data
encrypted over the wire using the encryption classes in the Cryptography
namespace. Since it's key-based encryption, I am hardcoding the encryption
key in the application code (rather than storing in a db or config file) and
will be running an obfuscator on the byte code so it will be tougher for
anyone to crack the key. Both the client and web-service will know the key
as well as the specific encryption/decryption algorithm in the Cryptography
namespace. The data going across the wire will be encrypted at all times.
The web-methods themselves will return byte arrays and take in byte arrays.

[WebMethod]
public byte[] getWhatever(int whatever key)
{
// return the data encrypted
}

[WebMethod]
public void SaveWhatever(by te[] encryptedData)
{
//
}

I don't think there's any annotations that can be used that will
automatically encrypt the data...

Please let me know if there are techniques that I can also use in addition
to the above... Not sure about certificates and the digital signatures as
I'm not sure how complex/complicated that would be? I'm wondering if the
method I'm using is sufficient for the most part? I mean, the encryption
routines in the Cryptography namespace are pretty good and hard to crack
from what I have been reading as long as nobody can get the key.

thanks in advance for any other assistance!!!

[=?Utf-8?B?TWFuaXNoIEJhZm5h?=]

Hi,
It is possible by using message level security.Find below the link which
provides sample/solution to your query:
http://www.c-sharpcorner.com/UploadF...ebService.aspx
--
If my answer helped you,then please do press Yes below.
Thanks and Regards.
Manish Bafna.
MCP and MCTS.

"The Big Fat Sloppy Pig!" wrote:

x-no-archive: yes

Hi All:

I'm sort of "new" to doing this so I was wondering if anyone can offer some
additional insight/suggestions.

I've created a web-service that will be receiving some customer-critical
information. I've written both the client application and the web-service.
We need to make sure the data is "non-translatable" as much as possible.
Ultimately, we could use SSL on top of the web-service but in the mean time,
I've decided to use the Cryptography features of .NET 1.1 to send the data
encrypted over the wire using the encryption classes in the Cryptography
namespace. Since it's key-based encryption, I am hardcoding the encryption
key in the application code (rather than storing in a db or config file) and
will be running an obfuscator on the byte code so it will be tougher for
anyone to crack the key. Both the client and web-service will know the key
as well as the specific encryption/decryption algorithm in the Cryptography
namespace. The data going across the wire will be encrypted at all times.
The web-methods themselves will return byte arrays and take in byte arrays.

[WebMethod]
public byte[] getWhatever(int whatever key)
{
// return the data encrypted
}

[WebMethod]
public void SaveWhatever(by te[] encryptedData)
{
//
}

I don't think there's any annotations that can be used that will
automatically encrypt the data...

Please let me know if there are techniques that I can also use in addition
to the above... Not sure about certificates and the digital signatures as
I'm not sure how complex/complicated that would be? I'm wondering if the
method I'm using is sufficient for the most part? I mean, the encryption
routines in the Cryptography namespace are pretty good and hard to crack
from what I have been reading as long as nobody can get the key.

thanks in advance for any other assistance!!!

[The Big Fat Sloppy Pig!]

x-no-archive: yes

thanks Manish. The article has given me further ideas. It abstracts the
Encryption from my internal classes to the soap header!!!

"Manish Bafna" <Ma*********@di scussions.micro soft.comwrote in message
news:FE******** *************** ***********@mic rosoft.com...

Hi,
It is possible by using message level security.Find below the link which
provides sample/solution to your query:

http://www.c-sharpcorner.com/UploadF...ebService.aspx

--
If my answer helped you,then please do press Yes below.
Thanks and Regards.
Manish Bafna.
MCP and MCTS.

"The Big Fat Sloppy Pig!" wrote:

x-no-archive: yes

Hi All:

I'm sort of "new" to doing this so I was wondering if anyone can offer

some

additional insight/suggestions.

I've created a web-service that will be receiving some customer-critical
information. I've written both the client application and the

web-service.

We need to make sure the data is "non-translatable" as much as possible.
Ultimately, we could use SSL on top of the web-service but in the mean

time,

I've decided to use the Cryptography features of .NET 1.1 to send the

data

encrypted over the wire using the encryption classes in the Cryptography
namespace. Since it's key-based encryption, I am hardcoding the

encryption

key in the application code (rather than storing in a db or config file)

and

will be running an obfuscator on the byte code so it will be tougher for
anyone to crack the key. Both the client and web-service will know the

key

as well as the specific encryption/decryption algorithm in the

Cryptography

namespace. The data going across the wire will be encrypted at all

times.

The web-methods themselves will return byte arrays and take in byte

arrays.

[WebMethod]
public byte[] getWhatever(int whatever key)
{
// return the data encrypted
}

[WebMethod]
public void SaveWhatever(by te[] encryptedData)
{
//
}

I don't think there's any annotations that can be used that will
automatically encrypt the data...

Please let me know if there are techniques that I can also use in

addition

to the above... Not sure about certificates and the digital

signatures as

I'm not sure how complex/complicated that would be? I'm wondering if

the

method I'm using is sufficient for the most part? I mean, the

encryption

routines in the Cryptography namespace are pretty good and hard to crack
from what I have been reading as long as nobody can get the key.

thanks in advance for any other assistance!!!