<p>I'm looking for a simple way to encrypt my soap communication in my C# Web-Service.</p>

<p>I was looking into <a href="http://www.google.com/url?sa=t&amp;ct=res&amp;cd=1&amp;url=http%3A%2F%2Fwww.microsoft.com%2Fdownloads%2Fdetails.aspx%3Ffamilyid%3D018a09fd-3a74-43c5-8ec1-8d789091255d&amp;ei=x1isSPTUO4bS0QXsjIzWAw&amp;usg=AFQjCNHn7aOkIXoysM1woIgRBe20Ptu_6g&amp;sig2=RTyvtw71nWYyoDGIEh0TlQ" rel="noreferrer">WSE 3.0</a> but it seems Microsoft dropped support for it, and therefore it's not straightforward to use.<br>
It seems WCF could've been an option but I prefer not to upgrade from .NET 2.0 .</p>

<p>Any <strong>simple</strong>, straightforward encryption method?</p>

[{'answer_id': 18452, 'author': 'Blair Conrad', 'author_id': 1199, 'author_profile': 'https://Stackoverflow.com/users/1199', 'pm_score': 0, 'selected': False, 'text': '<p>Perhaps I\'m being naive, but would forcing the communication to be via https be acceptable?\nI develop web services that run on 2.0 and have had success with just getting IIS to enforce https on the virtual directory. </p>\n\n<p>Alternatively, or in addition, you can check the <a href="http://msdn.microsoft.com/en-us/library/system.web.httprequest.issecureconnection.aspx" rel="nofollow noreferrer">HttpRequest.IsSecureConnection property</a>. </p>\n'}, {'answer_id': 18466, 'author': 'Blair Conrad', 'author_id': 1199, 'author_profile': 'https://Stackoverflow.com/users/1199', 'pm_score': 1, 'selected': False, 'text': "<blockquote>\n  <blockquote>\n    <p>Perhaps I'm being naive, but would\n    forcing the communication to be via\n    https be acceptable? I develop web\n    services that run on 2.0 and have had\n    success with just getting IIS to\n    enforce https on the virtual\n    directory.</p>\n  </blockquote>\n  \n  <p>That would be the simplest way to go\n  probably, but unfortunately I don't\n  have control over the IIS\n  configuration, and can't guarantee\n  that it can run https.</p>\n</blockquote>\n\n<p>In that case, perhaps the best bet is to either case-by-case encrypt portions of the SOAP messages (after all, you may not need the entire message to be encrypted - just certain sensitive fields?), or you could opt to use an HttpModule to intercept all the messages and operate on the contents. In either case you're probably going to have to provide custom proxies.</p>\n"}, {'answer_id': 18484, 'author': 'Nelson Miranda', 'author_id': 1130097, 'author_profile': 'https://Stackoverflow.com/users/1130097', 'pm_score': 4, 'selected': True, 'text': '<p>I think this can help; last year we used this to compress the webservices and it performed very well, I believe it could be enhanced with encryption classes;</p>\n\n<p><a href="http://www.mastercsharp.com/article.aspx?ArticleID=86&amp;&amp;TopicID=7" rel="noreferrer">Creating Custom SOAP Extensions - Compression Extension</a></p>\n'}, {'answer_id': 18492, 'author': 'Scott Marlowe', 'author_id': 1683, 'author_profile': 'https://Stackoverflow.com/users/1683', 'pm_score': 0, 'selected': False, 'text': '<p>We actually use WSE 3.0 in our web services, which were originally developed pre-WCF. For security, we use a SAML token based system built on the Cryptography classes in System.Security.</p>\n\n<p>It works very well. However, this method is by no means "simple".</p>\n'}, {'answer_id': 55730, 'author': 'tqbf', 'author_id': 5674, 'author_profile': 'https://Stackoverflow.com/users/5674', 'pm_score': 2, 'selected': False, 'text': '<p>Anything you do to provide "encryption" that isn\'t using SSL/TLS is likely to be vulnerable. Now you have to ask yourself, is it worth burning dev hours you could be spending on features on a rubber-chicken security measure? Maybe it is.</p>\n\n<p>.NET APIs like DPAPI and the Win32 crypt32 API make it easy to encrypt blobs of data with static keys. But how will your clients receive the keys? Any installed SOAP client will have to either have the key burned into its configuration, or receive it over the insecure Internet. </p>\n\n<p>This is the problem SSL/TLS solves for you; the dance you do with TLS certificates is what solves the problem of communicating public keys over untrusted channels. </p>\n'}, {'answer_id': 774327, 'author': 'backslash17', 'author_id': 91857, 'author_profile': 'https://Stackoverflow.com/users/91857', 'pm_score': 0, 'selected': False, 'text': '<p>You can use parameters encryption in C# using the System.Security.Cryptography extension.</p>\n\n<p>Encrypting your parameters and decrypting them would be harder but much more secure.</p>\n\n<p><a href="http://www.obviex.com/samples/Encryption.aspx" rel="nofollow noreferrer">How To: Encrypt and Decrypt Data Using a Symmetric (Rijndael) Key (C#/VB.NET)</a></p>\n\n<p>I\'m using this aproach for an OTP (one time password) web service, and it works fine for me.</p>\n'}]
['https://Stackoverflow.com/questions/18448', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1256645/']