Nonce is a randomly generated, cryptographic token. Nonce for integrity is used to specify that the nonce is embedded in a particular element and the element is signed.
For information on how to import your application, see Importing enterprise applications.
When nonce is added to the specific parts of a message, it might prevent theft and replay attacks because a generated nonce is unique. For example, without nonce, when a user name token is passed from one machine to another machine using a non-secure transport, such as HTTP, the token might be intercepted and used in a replay attack. The user name token can be stolen even if you use XML digital signature and XML encryption. However, it might be prevented by adding a nonce.
Complete the following steps to specify a nonce for integrity using keywords when you configure the generator security constraints for either the request generator or the response generator. The request generator is configured for the client and the response generator is configured for the server. In the following steps, you must configure either the client-side extensions in step 2 or the server-side extensions in step 3.
The following example is a SOAP message that has a nonce that is inserted in the SOAP message body and signed:
<soapenv:Envelope xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <soapenv:Header soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/ wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType= "http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="x509bst_1179110083179840266" xmlns:wsu="http://docs.oasis-open.org/ wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> E21hcnV5YW1hQGpwLmlib S5jb22CAgEBMA0GCSqGSIb3DQEBBQUAA4GBAHkthdGDgCvdIL9/vXUo74xpfOQd/rr1owBmMdb1TWdO yzwbOHC7lkUlnKrkI7SofwSLSDUP571iiMXUx3tRdmAVCoDMMFuDXh9V7212luXccx0s1S5KN0D3xW9 7LLNegQC0/b+aFD8XKw2U5ZtwbnFTRgs097dmz09RosDKkLlM </wsse:BinarySecurityToken> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <ec:InclusiveNamespaces PrefixList="wsse ds xsi soapenc xsd soapenv " xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:CanonicalizationMethod> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> <ds:Reference URI="#wssecurity_signature_id_8451968259110349556"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <ec:InclusiveNamespaces PrefixList="xsi soapenc xsd wsu soapenv " xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transform> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> <ds:DigestValue>HgfL7FiG/TGECE/L0zg5mJldfgc=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>iE2G53VMwCFBI6BwOWiaOLYvemZUJTXJocXpy8loyW1LiR8bBQcFioDOuD XXzVj3K+ZD2pYhc0krVYqkYY0IZoRx7xpWt+9qn7aSbxKjuHlMFNCdB1Uxp608zCZcSwvuoCffjl O0ltUQ8JTEBnmMB0cfaoiG5bFkUOEpkFo2P9c=</ds:SignatureValue> <ds:KeyInfo> <wsse:SecurityTokenReference> <wsse:Reference URI="#x509bst_1179110083179840266" ValueType=" http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509- token-profile-1.0#X509v3"/> </wsse:SecurityTokenReference> </ds:KeyInfo> </ds:Signature> </wsse:Security> </soapenv:Header> <soapenv:Body soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" wsu:Id="wssecurity_signature_id_8451968259110349556" xmlns:wsu="http://docs.oasis-open.org/ wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> <getVersion/> <wsse:Nonce wasextention="wedsig" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/ oasis-200401-wss-wssecurity-secext-1.0.xsd">1u0otbnjkPiCWDhh25yEyBHD/r3VPSbQ1oZTs0K s1GE/iDL4YbKDTwdL+e2Hb7nNZn397nRJQ9ePGgf7PRdEuqATFbfq0/T+6j6Fk/MbSHmZnHHoBscFX8W/dY ssyCmWDp99447kRhnJbNg5JxarkFmMLqpxKfm1iP3hKP5DpJY=</wsse:Nonce> </soapenv:Body> </soapenv:Envelope>
In this information ...Related concepts
Related tasks
| IBM Redbooks, demos, education, and more(Index) |