Re: how can we restrict what certificate WSE will use?

Curious, I had the same question to myself yesterday. However in the
context of a SsslStream and requiring client certs. In the callback I was
thinking you would look up a table of authorized SubjectNames and throw
exception if not found. Not sure if this pulls off the desired behavior or
not in all cases. If it did, I would think the same thing could be used in
your case.

--
William Stacey [MVP]

<jason.chen@xxxxxxxxxxxxxxxxx> wrote in message
news:e6xKqCgvFHA.2948@xxxxxxxxxxxxxxxxxxxxxxx
> HI Steven,
> thanks for the reply, it's good to know that X509SecurityTokenManager
> is
> called when X509SecurityToken is found in the context.
> there seems to be some disconnections where you say 'the hacker dosn't
> have
> the valid x509 certificate which is used to identify him'. I think the
> hacker can buy a valid x509 from Verisign and use it to identify him when
> accessing the webservice, right? the scenario I'm talking about is not man
> in the middle attack, it's more like how to prevent unwanted clients to
> access the webservice. I guess the solution is to write a custom
> X509SecurityTokenManager to verify the request is from a trusted client.
> and only requests passed the custom X509SecurityTokenManager will be
> decrypted, requests didn't pass the custom X509SecurityTokenManager will
> not
> be decrypted by WSE2, even though it might be properly encrypted and
> signed.
>
> am I right about this process?
>
> thanks,
> -Jason
>
> "Steven Cheng[MSFT]" <stcheng@xxxxxxxxxxxxxxxxxxxx> wrote in message
> news:aeRnsfcvFHA.580@xxxxxxxxxxxxxxxxxxxxxxxx
>> Hi Jason,
>>
>> The WSE2 will call X509SecurityTokenManager when find X509SecurityToken
>> in
>> the request Message's Security Context. However, the default
> implementation
>> of the verification is doing nothing, we can override it to do our custom
>> verification task (you can refer to the WSE2 's documentatin). Also, for
>> the hack which replace the message with the one signed by its own private
>> key, the problem is that he can not passed the authentication (suppose we
>> use Certificate authentication), since the hacker dosn't have the valid
>> x509 certificate which is used to identitfy him, he won't pass the
>> authentication at serverside , event no need to consider the sequential
>> decrypte and signature validation process. On the internet , a secure
>> channel include three elements:
>>
>> consistency, confidentiality and identification. And the identification
>> is
>> just used to determine the clientside's identity, generally we call this
>> process "Authentication". So when we use X509 certificate token for
>> auhenticaiton, we force the clientside to provide a server recoginzed
>> certificate token which the hacker won't have. This certificate could be
>> different from the one we used to sign or encrypt the message.
>>
>> Thanks,
>>
>> Steven Cheng
>> Microsoft Online Support
>>
>> Get Secure! www.microsoft.com/security
>> (This posting is provided "AS IS", with no warranties, and confers no
>> rights.)
>>
>> --------------------
>> From: <jason.chen@xxxxxxxxxxxxxxxxx>
>> References: <O9Bv4TJvFHA.3236@xxxxxxxxxxxxxxxxxxxx>
>> <TF7tg7MvFHA.780@xxxxxxxxxxxxxxxxxxxxx>
>> Subject: Re: how can we restrict what certificate WSE will use?
>> Date: Mon, 19 Sep 2005 18:26:01 -0400
>> Lines: 96
>> X-Priority: 3
>> X-MSMail-Priority: Normal
>> X-Newsreader: Microsoft Outlook Express 6.00.3790.326
>> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.326
>> Message-ID: <OA5sekWvFHA.2072@xxxxxxxxxxxxxxxxxxxx>
>> Newsgroups: microsoft.public.dotnet.framework.webservices.enhancements
>> NNTP-Posting-Host: a7cebc03.cst.lightpath.net 167.206.188.3
>> Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>> Xref: TK2MSFTNGXA01.phx.gbl
>> microsoft.public.dotnet.framework.webservices.enhancements:4922
>> X-Tomcat-NG: microsoft.public.dotnet.framework.webservices.enhancements
>>
>> thanks Steven, I'll be using a X509 certificate.
>> will the custom X509SecurityTokenManager be called before decryption and
>> signature verification?
>> you mentioned 'since his private key is not valid so, the signature of
>> his
>> message won't be able to be verified', actually I think the hacker can
> send
>> in a request signed with his valid private key, and since his public key
> is
>> sent alone with the request, so WSE2 can verify the request signature
>> successfully, true?
>> does WSE2 called X509SecurityTokenManager to validate a certificate
>> before
>> verifying request signature?
>>
>> thanks,
>> -Jason
>>
>> "Steven Cheng[MSFT]" <stcheng@xxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:TF7tg7MvFHA.780@xxxxxxxxxxxxxxxxxxxxxxxx
>> > Hi Jason,
>> >
>> > As for the question on the X509 certificate verification in .net
>> webservice
>> > using WSE, here are some of my understanding and suggestions:
>> >
>> > When a hacker use your public key (server certificate) to encrypte the
>> > message, it's ok. However, since his private key is not valid so, the
>> > signature of his message won't be able to be verified at the
>> > serverside.
>> > Also, we must have authentication protection at serverside through
>> > securityTokens(UsernameToken or X509CertificateToken ...). So are you
>> > using X509CertificateToken for authentication? If so you can consider
>> > defining a custom TokenManager class for X509Certificate
>> > Authentication.
>> > We can create such a class which dervied from the
>> >
>> > Microsoft.Web.Services2.Security.Tokens.X509SecurityTokenManager class
>> >
>> > This class has a "AuthenticateToken" method
>> >
>> > protected virtual void AuthenticateToken(
>> > X509SecurityToken token
>> > );
>> >
>> > which is used to verify the clientside x509certificate token, we can
>> > override this method in our custom manager class to do our own verfiy
>> > processing. Also, you can search the class in the WSE documentation
>> > and
>> > there're also reference on our to register custom Token Manager class
>> > within service's config file.
>> >
>> > Thanks,
>> >
>> > Steven Cheng
>> > Microsoft Online Support
>> >
>> > Get Secure! www.microsoft.com/security
>> > (This posting is provided "AS IS", with no warranties, and confers no
>> > rights.)
>> >
>> >
>> > --------------------
>> > From: <jason.chen@xxxxxxxxxxxxxxxxx>
>> > Subject: how can we restrict what certificate WSE will use?
>> > Date: Sun, 18 Sep 2005 17:07:24 -0400
>> > Lines: 18
>> > X-Priority: 3
>> > X-MSMail-Priority: Normal
>> > X-Newsreader: Microsoft Outlook Express 6.00.3790.326
>> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.326
>> > Message-ID: <O9Bv4TJvFHA.3236@xxxxxxxxxxxxxxxxxxxx>
>> > Newsgroups: microsoft.public.dotnet.framework.webservices.enhancements
>> > NNTP-Posting-Host: a7cebc03.cst.lightpath.net 167.206.188.3
>> > Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>> > Xref: TK2MSFTNGXA01.phx.gbl
>> > microsoft.public.dotnet.framework.webservices.enhancements:4914
>> > X-Tomcat-NG: microsoft.public.dotnet.framework.webservices.enhancements
>> >
>> > assume I'm hosting a webservice, I have 2 trusted clients consume my
>> > webservice, each client will send in properly encrypted and signed
>> request,
>> > WSE will take care of decryption and verification of the signature,
>> > everything works great. now there is a hacker, tries to consume my
>> > webservice, he encrypted his request using my public key, and signed
>> > his
>> > request using his own private key, when I received the request WSE will
>> > automatically decrypt it and verify the signature successfully before
>> > reaching my code where I verify it's a trusted client. as you can see,
> the
>> > decryption and signature verify happens automatically before I can
>> > check
>> if
>> > it's a trusted client.
>> >
>> > my question is, is there a way I can short circuit this process so that
> I
>> > can terminate the request before decryption/ signature verification
>> happens?
>> >
>> > thanks,
>> > -Jason
>> >
>> >
>> >
>>
>>
>>
>
>


.

Relevant Pages

  • Re: Client certificate private key prompt
    ... this when they need to make sure that no request every goes as anonymous. ... Upgrading the client to W2K3 will not solve the two prompt issue. ... the private key. ...
    (microsoft.public.dotnet.framework)
  • Re: how can we restrict what certificate WSE will use?
    ... \par Microsoft Online Support ... \par you mentioned 'since his private key is not valid so, the signature of his ... \par in a request signed with his valid private key, and since his public key is ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: how can we restrict what certificate WSE will use?
    ... you mentioned 'since his private key is not valid so, the signature of his ... in a request signed with his valid private key, and since his public key is ... > As for the question on the X509 certificate verification in .net ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Client Certificate not reaching server
    ... being sent in the actual request. ... I do have a private key installed. ... certificate is in the Local Computer/Personal store on the client machine. ...
    (microsoft.public.dotnet.security)
  • Question on the SSH-2 standard
    ... For instance, in section 7 of RFC 4252, ... signature generated using the private key. ... The client MAY send the ...
    (comp.security.ssh)