I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting.

Now my question is, after reading Understanding Protection Level what the advantage is of just signing? The fact that WCF will notice that someone has been messing around with the message and going to reject it or am I wrong?

Thanks in advance.


Encryption makes sure nobody else can read your message.

Signing makes sure it really comes from where it claims, and that nobody has changed the signed part.

Anyone can send you an encrypted message and claim it comes from someone else, as long as they have your public encryption key. But when they sign it, they need a private key, so if the signature checks out, you know that whoever wrote it had the private key in their possession.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.