Before you begin
Prior to completing this task, you must import your application into an assembly tool. For information on how to import your application, see Importing enterprise applications.Why and when to perform this task
Nonce for integrity is used to specify that the nonce is embedded in a particular element and the element is signed. Nonce is a randomly generated, cryptographic token. When nonce is added to the specific parts of a message, it might prevent theft and replay attacks because a generated nonce is unique. For example, without nonce, when a user name token is passed from one machine to another machine using a non-secure transport, such as HTTP, the token might be intercepted and used in a replay attack. The user name token can be stolen even if you use XML digital signature and XML encryption. However, it might be prevented by adding a nonce.
Complete the following steps to specify a nonce for integrity using keywords when you configure the generator security constraints for either the request generator or the response generator. The request generator is configured for the client and the response generator is configured for the server. In the following steps, you must configure either the client-side extensions in step 2 or the server-side extensions in step 3.
Steps for this task
Example
The following example is a SOAP message that has a nonce that is inserted in the SOAP message body and signed:
<soapenv:Envelope xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <soapenv:Header soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/ wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType= "http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="x509bst_1179110083179840266" xmlns:wsu="http://docs.oasis-open.org/ wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> E21hcnV5YW1hQGpwLmlib S5jb22CAgEBMA0GCSqGSIb3DQEBBQUAA4GBAHkthdGDgCvdIL9/vXUo74xpfOQd/rr1owBmMdb1TWdO yzwbOHC7lkUlnKrkI7SofwSLSDUP571iiMXUx3tRdmAVCoDMMFuDXh9V7212luXccx0s1S5KN0D3xW9 7LLNegQC0/b+aFD8XKw2U5ZtwbnFTRgs097dmz09RosDKkLlM </wsse:BinarySecurityToken> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <ec:InclusiveNamespaces PrefixList="wsse ds xsi soapenc xsd soapenv " xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:CanonicalizationMethod> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> <ds:Reference URI="#wssecurity_signature_id_8451968259110349556"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <ec:InclusiveNamespaces PrefixList="xsi soapenc xsd wsu soapenv " xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transform> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <ds:DigestValue>HgfL7FiG/TGECE/L0zg5mJldfgc=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>iE2G53VMwCFBI6BwOWiaOLYvemZUJTXJocXpy8loyW1LiR8bBQcFioDOuD XXzVj3K+ZD2pYhc0krVYqkYY0IZoRx7xpWt+9qn7aSbxKjuHlMFNCdB1Uxp608zCZcSwvuoCffjl O0ltUQ8JTEBnmMB0cfaoiG5bFkUOEpkFo2P9c=</ds:SignatureValue> <ds:KeyInfo> <wsse:SecurityTokenReference> <wsse:Reference URI="#x509bst_1179110083179840266" ValueType=" http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509- token-profile-1.0#X509v3"/> </wsse:SecurityTokenReference> </ds:KeyInfo> </ds:Signature> </wsse:Security> </soapenv:Header> <soapenv:Body soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" wsu:Id="wssecurity_signature_id_8451968259110349556" xmlns:wsu="http://docs.oasis-open.org/ wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <getVersion/> <wsse:Nonce wasextention="wedsig" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-wssecurity-secext-1.0.xsd">1u0otbnjkPiCWDhh25yEyBHD/r3VPSbQ1oZTs0K s1GE/iDL4YbKDTwdL+e2Hb7nNZn397nRJQ9ePGgf7PRdEuqATFbfq0/T+6j6Fk/MbSHmZnHHoBscFX8W/dY ssyCmWDp99447kRhnJbNg5JxarkFmMLqpxKfm1iP3hKP5DpJY=</wsse:Nonce> </soapenv:Body> </soapenv:Envelope>
What to do next
After you specify which message parts to digitally sign, you must specify which method is used to digitally sign the message. For more information, see Configuring signing information for the consumer binding with an assembly tool.Related concepts
XML digital signature
Related tasks
Adding a stand-alone time stamp in consumer security constraints
Adding time stamps for integrity in consumer security constraints with
keywords
Adding time stamps for integrity in consumer security constraints with
an XPath expression
Adding a nonce for integrity in consumer security constraints with
an XPath expression
Configuring signing information for the consumer binding with an assembly
tool