Section 12.6. A Brief History

12.6. A Brief History

When XML was conceived as a means to exchange business data across the Internet, it was immediately recognized that those documents had to be secured. Accordingly, in 1999, W3C and IETF jointly started the XML Signature Working Group to define a set of specifications for digitally signing XML documents. XML Signature became a W3C Recommendation in 2002. In parallel, W3C also worked on a new specification for encrypting parts of XML documents (XML Encryption). XML Encryption was also made into a W3C Recommendation in 2002.

Because SOAP is based on XML, it was natural to assume that XML Signature and XML Encryption should be used to protect SOAP messages. Thus, in April 2002, IBM, Microsoft, and VeriSign jointly published a specification of WS-Security, which later became the OASIS standard Web Services Security: SOAP Message Security 1.0 (WS-Security 2004). (This book will simply refer to it as WS-Security.) IBM and Microsoft also published a roadmap, laying out additional security specifications. Figure 12-1 was from that roadmap.