Thursday, 22 August 2013

Does TLS ensure message integrity and confidentiality of data transmission in a RESTful Java enterprise

Does TLS ensure message integrity and confidentiality of data transmission
in a RESTful Java enterprise

I want to apply web service security according to OWASP Web Service
Security. Thereby I stumbled over the two points:
Message Integrity
Message Confidentiality
So far there is just a RESTful service which can be directly accessed by a
client. For each request the client needs to authenticate by the server.
All communication is secured via TLS. I'm now unsure about Message
Integrity since I don't understand the sentence:
When using public key cryptography, encryption does guarantee
confidentiality but it does not guarantee integrity since the receiver's
public key is public. For the same reason, encryption does not ensure the
identity of the sender.
Is it also required that the data was signed by the client in order that
message integrity is ensured?
Concerning Message Confidentiality, I understood it as follows.
Use TLS to ensure message confidentiality over the wire.
Use a symmetric encryption to encrypt the transmitted data.
The encrypted data get stored in data base.

No comments:

Post a Comment