|
XML encryption is relevant when using the multi-hop
feature of ebMS. SSL only secures the data in transit between hops.
The messages would (temporarily) be in clear text at the store-and-forward
intermediary. In some environments, this is seen as a risk (when is the
message store purged, who has read permission for the file system storing
these messages, are they security cleared..).
The ebMS2 spec says that "The XML Encryption
standard shall be the default encryption
method when XML Encryption has achieved W3C Recommendation status",
which
was on 10 december 2002. There are products that do
support XML Encryption with ebMS2 /
HTTP. It's unfortunate Hermes doesn't appear to be one of
them.
Pim van der
Eijk From: Gait Boxman [mailto:gait.boxman@tie.nl] Sent: 15 December 2006 08:38 To: ebxml-dev@lists.ebxml.org Subject: Re: [ebxml-dev] Hermes1: Howto configure Persistent Confidentiality? depends on what you mean by that exactly. If you ask: will Hermes do XML Encryption for me and how do I turn that on? No, Hermes implements ebMS 2.0, and at the time of that spec, XML Enc was not ready yet. If you ask will Hermes send XML Encrypted payloads? Yes, Hermes will send any payload, just make sure it's identified correctly, see David's response as well. If you ask can I build a Hermes client that will do this transparently from the rest of my environment? Depends on your programming skills, but I'd say it can be done. However, that would defeat the purpose of the encryption. All traffic of ebMS can be SSL encrypted (for HTTP) or S/MIME encrypted (for mail transfer), and the client/server traffic inside Hermes can run over HTTPS. If you want *persistent* encryption, you need Hermes to deliver the payload encrypted anyway.. I believe ebMS 3.0 introduces XML Enc as a replacement/alternative for S/MIME mail encryption, but that won't help you for your persistent requirement. Out of curiosity, why do you need persistent encryption, is the receiving Hermes client system not trustworthy? kind regards, Gait Boxman. Kappe, Albert wrote:
|