Take the 2-minute tour ×

I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting.

Now my question is, after reading Understanding Protection Level what the advantage is of just signing? The fact that WCF will notice that someone has been messing around with the message and going to reject it or am I wrong?

Thanks in advance.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Encryption makes sure nobody else can read your message.

Signing makes sure it really comes from where it claims, and that nobody has changed the signed part.

Anyone can send you an encrypted message and claim it comes from someone else, as long as they have your public encryption key. But when they sign it, they need a private key, so if the signature checks out, you know that whoever wrote it had the private key in their possession.

share|improve this answer
Nice explanation, thanks! –  Tom Kerkhove May 29 '13 at 18:43

Your Answer


