TEC Workbook - IBM

IBM Software
3.2 WS-Security Digital Signatures
The term “digital signature” refers to something created using public key technology. Two keys are
involved: a private key, which only you know, and a corresponding public key, which you can freely give
to anyone. What makes this key pair interesting is that anything encrypted using one key can only be
decrypted with the other one.
The primary usage of digital signatures is to verify the integrity of a transmitted message. When a
message travels over public networks, it can be intercepted, modified, and then forwarded without
detection. Adding a digital signature to a message enables the recipient of the message to determine
whether the message has been altered along the way.
For example, assume a business partner wants to send you a digitally signed message. First, they will
compute a special checksum on the message they want to send (this is often referred to as a message
digest). Then they encrypt the digest with their private key. The result is a digital signature for the
message. They send this digital signature along with the original message to you.
When you receive the message, you’ll first compute the message digest on the received message. You’ll
then use the sender’s public key to decrypt the message digest that was sent along with the message. If
the message digest that you calculated and the one that you decrypted are identical, then you can be
certain that the data wasn’t changed in transit (integrity) and that the data was signed by the business
partner (authentication).
Creating and verifying digital signatures involve a considerable amount of mathematical computations,
and are thus very processor intensive. WebSphere DataPower employs cryptographic hardware to do
these calculations, thus freeing up costly processor cycles for business-related tasks.
In this section, you’ll configure your ProductServiceProxy to:
1. Verify a digital signature generated by soapUI. If the verification fails, reject the request.
2. Strip the digital signature from the request before forwarding it to the backend service.
3. Add a digital signature to the service’s response and return the signed response to soapUI.
3.2.1 Crypto objects
In lab 1, you uploaded several PKI files. Keys and certificates generally have expiration dates, thus
requiring occasional replacement. To avoid the need to change multiple configurations each time a key
or certificate needs updating, keys and certificates are wrapped in Crypto Key and Crypto Certificate
objects. These crypto objects add a level of indirection to the underlying keys and certs, averting the
need to update affected configurations each time key or certificate maintenance occurs.
The following steps will guide you in creating a Crypto Key object that wraps ProductServiceprivkey.pem,
and Crypto Certificates that wrap ProductService-sscert.pem and soapUI.pem.
Page 54 WebSphere Lab Jam