CODEWITHSUNDEEP
.netwcfencryption
Cristian Lupascu
Cristian Lupascu

Reputation: 40506

WCF Message Encryption without Authentication/Authorization or Certificates

I have a .NET 4.0 project with two modules that will communicate via WCF services and I'd like to implement a custom encryption mechanism.

My scenario:

Can anyone point out what would be the most obvious solution to implement this scenario using WCF?

Upvotes: 1

Views: 1457

Answers (1)

Ladislav Mrnka
Ladislav Mrnka

Reputation: 364249

I would say that you don't want security - static key for encrypting messages with symmetric encryption algorithm is just a notion of security.

Anyway if you want to do that there are really extension points which will allow you to do that on many different levels.

  • Encrypting the whole message - that would require custom message encoder which can be quite hard to write.
  • Encrypting the body of the message - you can write custom IMessageInspector which will deal with encryption and decryption of message body. Headers will be still in plain text which is necessary unless you want to change many other things in WCF processing. You can wrap the inspector in custom IEndpointBehavior and use it either imperatively in the code or declaratively in the configuration (you will also need implementing custom BehaviorExtenxionElement).
  • Encrypting only some operations marked with custom IOperationBehavior or some data marked with IContractBehavior behavior and using IParameterInspector to decrypt and encrypt value.

You have control over both client and server - use certificates instead of fake security.

Upvotes: 2

Related Questions