Set the server for response signing: choosing the digital signature method

Set the server for response signing: choosing the digital signature method

Use an assembly tool to specify which digital signature method to use when configuring the server for response signing.
There is an important distinction between Version 5.x and V6 and later applications. The information in this article supports V5.x applications only that are used with WAS V6.0.x and later. The information does not apply to V6.0.x and later applications. Prior to completing these steps, read either of the following topics to become familiar with the Extensions tab and the Binding configurations tab in the Web services editor within the IBM assembly tools:

Set the server security bindings using an assembly tool
Set the server security bindings

These two tabs are used to configure the WS-Security extensions and the WS-Security bindings, respectively.
Complete the following steps to specify which digital signature method to use when configuring the server for response signing:

Launch an assembly tool.
See the related information on Assembly Tools.
Switch to the Java EE perspective. Click Window > Open Perspective > J2EE.
Click EJB Projects > application _name >ejbModule > META-INF.
Right-click the webservices.xml file and click Open with > Web services editor.
Click the Binding Configurations tab.
Expand Response sender binding configuration details > Signing information.
Click Edit to choose a signing method. The signing info dialog is displayed and either select or enter the following information:

Canonicalization method algorithm
Digest method algorithm
Signature method algorithm
Signing key name
Signing key locator

The following table describes the purpose of this information. Some of these definitions are based on the XML-Signature specification, which is located at the following address: http://www.w3.org/TR/xmldsig-core.

Table 1. Digital signature methods

Name Purpose
Canonicalization method algorithm Canonicalizes the <SignedInfo> element before the information is digested as part of the signature operation. Use the same algorithm on the client response receiver. The algorithm selected for the server response sender configuration must match the algorithm selected in the client response receiver configuration.
Digest method algorithm Applies to the data after transforms are applied, if specified, to yield the <DigestValue> element. Signing the <DigestValue> element binds resource content to the signer key. The algorithm selected for the server response sender configuration must match the algorithm selected in the client response receiver configuration.
Signature method algorithm Converts the canonicalized <SignedInfo> element into the <SignatureValue> element. The algorithm selected for the server response sender configuration must match the algorithm selected in the client response receiver configuration.
Signing key name Represents the key entry associated with the signing key locator. The key entry refers to an alias of the key, which is found in the key store and is used to sign the request.
Signing key locator Represents a reference to a key locator implementation class that locates the correct key store where the alias and certificate exists.
See on configuring key locators, see any of the following files:

Set key locators using an assembly tool
Set key locators
Set server and cell level key locators

Select Show only FIPS Compliant Algorithms if we only want the FIPS compliant algorithms to be shown in the Signature method algorithm and Digest method algorithm dropdown lists. Use this option if we expect this application to be run on a WAS that has set the Use the United States FIPS (FIPS) algorithms option in the SSL certificate and key management panel of the admin console for WAS.

Results
we have specified which method is used to digitally sign a message when the server sends a message to a client.

Next steps
After you configure the server to digitally sign the response message, configure the client to verify the digital signature contained in the response message. See Set the client for response digital signature verification: verifying the message parts for more information.

Related concepts

Response sender
Response receiver
XML digital signature
Assembly tools

Related tasks

Set key locators using an assembly tool
Set key locators
Set server and cell level key locators
Set the server for response signing: digitally signing message parts
Set the server security bindings using an assembly tool
Set the server security bindings
Secure Web services for V5.x applications using XML digital signature

Related information

http://www.w3.org/TR/xmldsig-core.html

Name	Purpose
Canonicalization method algorithm	Canonicalizes the <SignedInfo> element before the information is digested as part of the signature operation. Use the same algorithm on the client response receiver. The algorithm selected for the server response sender configuration must match the algorithm selected in the client response receiver configuration.
Digest method algorithm	Applies to the data after transforms are applied, if specified, to yield the <DigestValue> element. Signing the <DigestValue> element binds resource content to the signer key. The algorithm selected for the server response sender configuration must match the algorithm selected in the client response receiver configuration.
Signature method algorithm	Converts the canonicalized <SignedInfo> element into the <SignatureValue> element. The algorithm selected for the server response sender configuration must match the algorithm selected in the client response receiver configuration.
Signing key name	Represents the key entry associated with the signing key locator. The key entry refers to an alias of the key, which is found in the key store and is used to sign the request.
Signing key locator	Represents a reference to a key locator implementation class that locates the correct key store where the alias and certificate exists. See on configuring key locators, see any of the following files: Set key locators using an assembly tool Set key locators Set server and cell level key locators