We've talked frequently about Simple Object Access Protocol (SOAP) in this column. After all, it's central to communication among the objects that make up distributed applications, particularly in a Web Services environment. We've not, however, given much coverage to SOAP Security Extensions: Digital Signature (SOAP-DSIG). 

As you might conclude from the name of the technology, SOAP-DSIG defines a SOAP message with a digital signature attached to it. As with other things (such as electronic mail messages) that can be digitally signed, SOAP-DSIG messages have the advantage of being relatively safe from tampering (altering the contents of a message en route to its recipient), replay attacks (sending malicious subsequent copies of an originally legitimate message), and spoofing (sending a message that appears to be from some source, when it's in fact from another).

Those capabilities go well beyond what's possible under Hypertext Transport Protocol (HTTP) with Secure Sockets Layer (SSL) encryption. SSL does indeed prevent en route tampering with transmitted information, but SSL is really best at what it was designed to do: Protecting dialogs between Web clients and Web servers in which large volumes of information are exchanged. It doesn't provide proof of authorship (authentication, in other words) or non-repudiation (in which a sender claims later, truthfully or not, to have not sent a message that appears to have come from him).

Key to the enhanced authentication and non-repudiation capabilities of SOAP-DSIG is its use of public key encryption. This contrasts with SSL, which uses a private secret that's shared between the two communicating parties for encryption. Public key encryption requires more work, but it provides a greater set of features.

SOAP-DSIG is implemented by adding a <SOAP-SEC:Signature> element to the SOAP envelope. After encapsulating the SOAP message in an HTTP frame, you can SSL-encrypt the lot for protection against tampering and unwanted observation.