A discussion of why SSL does not always provide a suitable method of authentication for Web services

Introduction

Since its inception in March 1995, when it was used in Netscape 1.1, SSL has become the de facto way to encrypt data sent between HTTP requesters (Web browsers) and HTTP servers (Web servers). Because of this, SSL is an obvious security choice for first-generation Web services. SSL works at the session layer of the OSI stack to provide point-to-point confidentiality and one-way or two-way authentication. Used alone, however, SSL does not provide complete protection for first-generation Web services.

SSL provides only partial protection for first generation Web services

Most first-generation Web services have been deployed in internal integration projects behind a company's firewall. However, some companies are now deploying Web services to expose internal systems over the Internet to business partners or distributed divisions. Early adopters of Web services technology can be found in the financial, government, and healthcare sectors, where risk of attack is greater as the data exchanged is often of a sensitive or high value nature.

SSL provides adequate confidentiality for first-generation Web services. Using SSL the channel over which two parties communicate can be kept confidential - data is encrypted by the sender and decrypted by the recipient. First- generation Web services, typically involve passing of messages between two points only, so ensuring confidentiality at the session layer is sufficient.

However, SSL does not always provide a suitable method of authentication for Web services. With server-side SSL the client obtains a copy of the Web server's certificate, allowing it to authenticate the server and establish an encrypted channel. This one-way means of authentication is commonly used in B2C environments where the functionality clients can access is fairly innocuous, as typically Web sites expose limited functionality. For example with B2C book sites the risk is mitigated on the seller side by the low value of the transactions and on the buyer side by the low credit card liability limit. The predominant risk is that a third party might steal credit card or other private details from the end-user by intercepting a message or by impersonating a Web server.

Full Article: WebServices.org