+

Search Tips   |   Advanced Search

 

Configure the client for response decryption: choosing a decryption method

 

To configure the client for response decryption, specify which decryption method to use when the client decrypts the response message. The server response encryption and client response decryption configurations must match.

There is an important distinction between V5.x and V6 and later applications. The information in this article supports V5.x applications only that are used with WAS V6.0.x and later. The information does not apply to V6.0.x and later applications. Prior to completing these steps, read either of the following topics to become familiar with the WS Extensions tab and the WS Bindings tab in the Client Deployment Descriptor Editor within an assembly tool:

These two tabs are used to configure the Web services security extensions and Web services security bindings, respectively.

 

Overview

Complete the following steps to specify which decryption method to use when the client decrypts the response message. The server response encryption and client response decryption configurations must match.

 

Procedure

  1. Launch an assembly tool. For more information on the assembly tools, see Assembly tools.

  2. Switch to the J2EE perspective. Click Window > Open Perspective > J2EE.

  3. Click Application Client Projects > application > appClientModule > META-INF.

  4. Right-click the application-client.xml file, select Open with > Deployment descriptor editor.

  5. Click the WS Binding tab, which is located at the bottom of the deployment descriptor editor within the assembly tool.

  6. Expand the Security response receiver binding configuration > Encryption information section. For more information on encrypting and decrypting SOAP messages, see XML encryption.

  7. Click Edit to view the encryption information. The following table describes the purpose for this information. Some of these definitions are based on the XML-Encryption specification, which is located at the following Web address:  http://www.w3.org/TR/xmlenc-core

    Encryption name

    Refers to the alias that is used for the encryption information entry.

    Data encryption method algorithm

    Encrypts and decrypts data in fixed size, multiple octet blocks.

    Key encryption method algorithm

    Represents public key encryption algorithms specified for encrypting and decrypting keys.

    Encryption key name

    Represents a Subject from a personal certificate, which is typically a distinguished name (DN) that is found by the encryption key locator. The Subject is used by the key encryption method algorithm to decrypt the secret key. The secret key is used to decrypt the data.

    The key chosen must be a private key of the client. Encryption must be done using the public key and decryption must be done by the private key (personal certificate). For example, the personal certificate of the client is: CN=Alice, O=IBM, C=US. Therefore, the client contains the public and private key pair. The target server that sends the response encrypts the secret key by using the public key for CN=Alice, O=IBM, C=US. The client decrypts the secret key by using the private key for CN=Alice, O=IBM, C=US.

    Encryption key locator

    Represents a reference to a key locator implementation class that finds the correct key store where the alias and the certificate exist. For more information on configuring key locators, see Configure key locators using an assembly tool and Configuring key locators using the console.

     

  8. Optional: Select Show only FIPS Compliant Algorithms if you only want the FIPS compliant algorithms to be shown in the Data Encryption method algorithm and Key Encryption method algorithm drop-down lists. Use this option if you expect this application to be run on a WAS that has set the Use the United States Federal Information Processing Standard (FIPS) algorithms option in the SSL certificate and key management panel of the console for WAS.

 

Results

For decryption, the encryption key name chosen must refer to a personal certificate that can be located by the client key locator. The Subject (owner field of the certificate) of the personal certificate should be entered in the Encryption key name, this is typically a Distinguished Name (DN).  The default key locator uses the Encryption key name to find the key within the keystore. If you write a custom key locator, the encryption key name can be anything used by the key locator to find the correct encryption key. The encryption key locator references the implementation class that locates the correct key store where this alias and certificate exists. For more information, see Configure key locators using an assembly tool and Configuring key locators using the console.

 

What to do next

You must specify which parts of the request message to decrypt. See the topicConfigure the client for response decryption: decrypting the message parts if you have not previously specified this information.


 

Related concepts


XML encryption
Response receiver

 

Related tasks


Configure the client for response decryption: decrypting the message parts
Configure the client security bindings using an assembly tool
Configure the security bindings on a server acting as a client using the console
Configure key locators using an assembly tool
Configure key locators using the console

 

Related information


XML Encryption Syntax and Processing W3C Recommendation 10 December 2002