DSig

We need to ask the question whether or not to using SOAP-DSIG and SSL simultaenously is sufficient for non-repudiation in B2B applications.

The original motivation for SOAP-DSIG was to append digital signatures to SOAP messages.

Therefore, using SOAP-DSIG and SSL (with client authentication) simultaneously is the first step towards realizing non-repudiation.

Specifically, SOAP-DSIG defines a data format for appending an XML signature to a SOAP message.

Because the confidentiality requirement is satisfied by using SSL and is not addressed by SOAP-DSIG, I will not cover it in this article.

Now I'll examine the relationship between SOAP-DSIG and SSL from the perspective of non-repudiation.

Table 1 summarizes which security requirements can be satisfied by SOAP-DSIG and SSL.

It is important to note that you can use SOAP-DSIG and SSL simultaneously by exchanging the above HTTP messages over SSL.

Similarly, the receipt can be signed by using SOAP-DSIG.

That is, SOAP-DSIG is used to satisfy the message authentication requirement.

How are SOAP-DSIG and SSL combined in order to realize it?

Enter name for public crypto certificate, WS-dsig-receiver-public

Table 1: Security requirements satisfied by SOAP-DSIG and SSL 1