Share via

5.1 Security Considerations for Implementers

  • Article

A sender can include a digital certificate and request authentication when sending a UserMessage Packet ([MS-MQMQ] section 2.2.20). A sender can request encryption of the message body to ensure message privacy. Use of the AES encryption algorithm is recommended for the best encryption strength.

Authentication and encryption are not supported when a message is sent to a queue using a direct format name. The information in a UserMessage Packet that is sent using a direct format name is susceptible to tampering.

A receiver authenticates received UserMessage Packets by verifying an included digital signature and certificate. The receiver performs an access check to authorize the message sender to the destination queue.

Administration Nacks of classes MQMSG_CLASS_NACK_ACCESS_DENIED, MQMSG_CLASS_NACK_BAD_DST_Q, MQMSG_CLASS_NACK_BAD_ENCRYPTION, MQMSG_CLASS_NACK_BAD_SIGNATURE, and MQMSG_CLASS_NACK_UNSUPPORTED_CRYPTO_PROVIDER present potential security vulnerabilities. The receiving queue manager disables generation of these Nacks by default. The ability to temporarily enable them when required to diagnose a configuration or application issue is useful.