Message/Password Encryption

[Andreas Zita]

Hi!

I have a web service (c# .net 1.1) which is validating some credentials
before processing a certain request.

Initially I was only encrypting the accual passwordstring such as:

<password>encryptedpassword</password>

But when thinking about it I realized that this really approach really
doesnt help much since if a hacker sniffs this message he essentially has
the "magic word" needed to access my web service. He really doesnt need the
unencrypted password. Is this a correct conclution? Anyway, this led me to
encrypting the entire message instead ... (cant use SSL since the server
wont always to accessible for this kind of setup)

The real question: Where should I store the encryption key (TripleDES). At
the moment I store the key right in the code on both the client and the
server application. I have a feeling this is very bad. But where is the
right place to store enc.keys ?

/Andreas Zita

[Softwaremaker]

Have you taken a look at WS-Security ? WSE implements it.
http://msdn.microsoft.com/webservices/building/wse/

--
Thank you.

Regards,
William T (Softwaremaker)
http://www.softwaremaker.net/blog

Independent Microsoft Regional Director | Microsoft MVP - Solutions
Architect
================================================== ====
"Andreas Zita" <an******@student.liu.se> wrote in message
news:ul**************@TK2MSFTNGP09.phx.gbl...

Hi!

I have a web service (c# .net 1.1) which is validating some credentials
before processing a certain request.

Initially I was only encrypting the accual passwordstring such as:

<password>encryptedpassword</password>

But when thinking about it I realized that this really approach really
doesnt help much since if a hacker sniffs this message he essentially has
the "magic word" needed to access my web service. He really doesnt need the unencrypted password. Is this a correct conclution? Anyway, this led me to
encrypting the entire message instead ... (cant use SSL since the server
wont always to accessible for this kind of setup)

The real question: Where should I store the encryption key (TripleDES). At
the moment I store the key right in the code on both the client and the
server application. I have a feeling this is very bad. But where is the
right place to store enc.keys ?

/Andreas Zita