Secure Silverlight to Web-Service communication without IIS using Public-key cryptography

Question

If I have a Silverlight client connecting to a web service hosted in a windows service, there's no obvious way to secure communications between the two if you're not using IIS. SSL isn't available, and wsHttpBinding isn't supported by Silverlight.

So here's what I'm planning on doing, and just wanted to see if I'd missed any obvious security holes. This will all be on an intranet, SSL-secured hosting on IIS will be used if we ever make it internet-enabled.

1. Create a certificate and put it in the user store for the service account for the web service. Web-service retrieves the certificate keys on startup.
2. Add a clear-text method to the web service to return the public key from the certificate as a string.
3. Call the web-service from the Silverlight client to get the public key.
4. Encrypt all data sent to the web-service from the Silverlight client using the public key. The data returned to the Silverlight client does not need to be encrypted.

Am I missing anything? I can't figure out any other way to do it!

Answer 1

You can't encrypt large ammounts of data with RSA cryptography, is just too darn slow (100s of ms per RSA modulus length I think). All schemes use RSA to bootstrap a symmetric key and encrypt the data using this key. Use any of the established key exchange protocols. You'd be surprised how easy is to implement SSL 3.0 or TLS 1.0 if you have a copy of Rescorla's book SSL and TLS: Designing and Building Secure Systems